CVE-2025-59050 in Greenshot
Summary
by MITRE • 09/16/2025
Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The vulnerable logic resides in a WinForms WndProc handler for WM_COPYDATA (message 74) that copies the supplied bytes into a MemoryStream and invokes BinaryFormatter.Deserialize, and only afterward checks whether the specified channel is authorized. Because the authorization check occurs after deserialization, any gadget chain embedded in the serialized payload executes regardless of channel membership. A local attacker who can send WM_COPYDATA to the Greenshot main window can achieve in-process code execution, which may aid evasion of application control policies by running payloads within the trusted, signed Greenshot.exe process. This issue is fixed in version 1.3.301. No known workarounds exist.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/03/2025
CVE-2025-59050 represents a critical deserialization vulnerability in Greenshot version 1.3.300 and earlier, where the application fails to properly validate or authenticate data received through Windows messaging mechanisms. This flaw exists within the WinForms message handling system specifically targeting the WM_COPYDATA message type with identifier 74, which is commonly used for inter-process communication on Windows platforms. The vulnerability stems from the application's improper order of operations where BinaryFormatter.Deserialize is invoked before authorization checks occur, creating a fundamental security gap that allows arbitrary code execution.
The technical implementation of this vulnerability occurs within the WndProc handler of the Greenshot application's main window, where incoming WM_COPYDATA messages are processed by copying the raw byte data into a MemoryStream and subsequently passing it to BinaryFormatter.Deserialize. This deserialization process executes any malicious gadget chains embedded within the serialized payload regardless of the sender's authorization status, as the access control validation happens after the dangerous deserialization operation has already completed. The flaw manifests because the application employs a flawed security model where authentication occurs post-deserialization, allowing attackers to leverage the .NET BinaryFormatter's capabilities to execute arbitrary code within the context of the Greenshot process.
From an operational perspective, this vulnerability enables local privilege escalation attacks where an attacker with access to the same integrity level can send specially crafted WM_COPYDATA messages to the Greenshot process, resulting in arbitrary code execution without requiring elevated privileges. The impact extends beyond simple code execution as it provides a potential vector for bypassing application control policies, since the malicious payload runs within the trusted, signed Greenshot.exe process. This characteristic makes the vulnerability particularly dangerous for enterprise environments where application whitelisting or control mechanisms might not detect the malicious activity due to the legitimate process context. The attack requires only local access and knowledge of the target process, making it accessible to attackers who have already compromised the system or are operating at the same user level.
The vulnerability aligns with CWE-502, which specifically addresses "Deserialization of Untrusted Data," and demonstrates a classic case of improper input validation leading to remote code execution. It also relates to ATT&CK technique T1059.001 for command and scripting interpreter, where adversaries use legitimate system tools to execute malicious code, and T1073.001 for external remote services, since the attack vector leverages Windows inter-process communication mechanisms. Organizations should immediately update to Greenshot version 1.3.301 or later, as no effective workarounds exist for this vulnerability. The fix addresses the core issue by reordering the security checks to validate authorization before deserialization occurs, preventing malicious gadget chains from executing regardless of the sender's credentials. System administrators should also monitor for suspicious WM_COPYDATA activity and consider implementing additional process monitoring to detect potential exploitation attempts.