CVE-2025-59050 Greenshot — Insecure .NET deserialization via WM_COPYDATA enables local code execution
A local attacker can execute arbitrary code in Greenshot by sending malicious serialized data via WM_COPYDATA, bypassing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-59050?
CVE-2025-59050 is a high-severity unsafe deserialization vulnerability in greenshot, published on 16 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Greenshot is an open source Windows screenshot utility. Greenshot 1.3.300 and earlier deserializes attacker-controlled data received in a WM_COPYDATA message using BinaryFormatter.Deserialize without prior validation or authentication, allowing a local process at the same integrity level to trigger arbitrary code execution inside the Greenshot process. The vulnerable logic resides in a WinForms WndProc handler for WM_COPYDATA (message 74) that copies the supplied bytes into a MemoryStream and invokes BinaryFormatter.Deserialize, and only afterward checks whether the specified channel is authorized. Because the authorization check occurs after deserialization, any gadget chain embedded in the serialized payload executes regardless of channel membership. A local attacker who can send WM_COPYDATA to the Greenshot main window can achieve in-process code execution, which may aid evasion of application control policies by running payloads within the trusted, signed Greenshot.exe process. This issue is fixed in version 1.3.301. No known workarounds exist.
Weakness: CWE-502
Which versions are affected by CVE-2025-59050?
It affects 1 product.
Products include Getgreenshot Greenshot.
How do I fix CVE-2025-59050?
No fix has been published for CVE-2025-59050 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-59050 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59050 exists.
Other vulnerabilities in greenshot
Sources
Also known as GHSA-8f7f-x7ww-xx5w.