CVE-2026-16477 Insecure Deserialization of .cleanshot Files in CleanShot X
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-16477?
CVE-2026-16477 is a high-severity vulnerability in MTW CleanShot X, published on 22 Oct 2026.
Official description
CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10
Weakness: CWE-502
Which versions are affected by CVE-2026-16477?
How do I fix CVE-2026-16477?
No fix has been published for CVE-2026-16477 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-16477 being exploited?
There is no known exploitation of CVE-2026-16477 in the wild and no public exploit code.
Sources
Also known as GHSA-9gj2-4mhg-73v2.