Windows Greenshot Vulnerability Lets Attackers Execute Malicious Code – PoC Published

A critical security vulnerability in the Greenshot screenshot utility has been disclosed, allowing local attackers to execute arbitrary code within the trusted Greenshot process. The flaw, tracked as CVE-2025-59050, affects Greenshot versions up to 1.3.300 and was patched in version 1.3.301 released on 16 September 2025.

It stems from Greenshot’s unsafe handling of Windows inter-process communication via the WM_COPYDATA message system, where attacker-controlled data is deserialized with BinaryFormatter[.]Deserialize() without proper validation and before any authorization checks. The vulnerability can be exploited by any local process at a compatible integrity level to cause code execution inside Greenshot.exe, enabling evasion of certain security controls since the code runs in memory rather than in a new process.

A PoC demonstrates locating Greenshot’s window, building a serialized payload, and triggering execution using SendMessage calls, with the exploit reportedly spawning cmd.exe as a proof of concept. Users are advised to update to version 1.3.301, available from the official Greenshot site, according to getgreenshot[.]org.