CVE-2025-59050 Details

A local code execution vulnerability has been identified in Greenshot, an open-source Windows screenshot utility, in versions through 1.3.300. The issue arises from the deserialization of attacker-controlled data in WM_COPYDATA messages using BinaryFormatter.Deserialize, without proper validation or authorization. This vulnerability allows a local process at the same integrity level to execute arbitrary code within the Greenshot process. The flaw exists in a WinForms WndProc handler for WM_COPYDATA, where the application first deserializes the data and only later checks if the channel is authorized. As a result, any embedded gadget chain in the serialized payload is executed regardless of channel membership. A local attacker capable of sending WM_COPYDATA to the Greenshot main window can exploit this for in-process code execution, potentially evading application control policies by running malicious payloads within the trusted Greenshot.exe process.

Users can upgrade to Greenshot version 1.3.301, which addresses this vulnerability by implementing a safety check for the BinaryFormatter deserialization when handling WM_COPYDATA messages.