CVE-2025-59050: Greenshot Deserialization RCE Vulnerability

CVE-2025-59050 Overview

CVE-2025-59050 is an insecure deserialization vulnerability [CWE-502] in Greenshot, an open-source Windows screenshot utility. Versions 1.3.300 and earlier deserialize attacker-controlled data received through WM_COPYDATA messages using BinaryFormatter.Deserialize without prior validation. A local process running at the same integrity level can send a crafted message to the Greenshot main window and trigger arbitrary code execution inside the signed Greenshot.exe process. The vulnerability is fixed in version 1.3.301.

Critical Impact
Local attackers can execute arbitrary code inside the trusted, signed Greenshot process, which may enable bypass of application control policies such as Windows Defender Application Control (WDAC) and AppLocker.

Affected Products

Greenshot 1.3.300 and earlier
Getgreenshot Greenshot on Windows
Fixed in Greenshot 1.3.301

Discovery Timeline

2025-09-16 - CVE-2025-59050 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-59050

Vulnerability Analysis

The vulnerability resides in Greenshot's inter-process communication handler for WM_COPYDATA (Windows message 74). The WinForms WndProc handler copies the supplied byte payload into a MemoryStream and immediately invokes BinaryFormatter.Deserialize on the attacker-controlled data. Channel authorization is checked only after deserialization completes, so any gadget chain embedded in the serialized stream runs regardless of whether the sender belongs to an authorized channel.

BinaryFormatter is a well-documented unsafe .NET deserializer. Microsoft has deprecated it because embedded type metadata allows an attacker to instantiate arbitrary types and invoke setters, constructors, and callback methods during graph reconstruction. Established gadget chains such as TypeConfuseDelegate and ObjectDataProvider translate directly into command execution.

Root Cause

The root cause is the ordering of operations in CopyData.cs: the handler deserializes untrusted input before verifying the sender's authorization to the target channel. Trust decisions occur after the dangerous parsing step has already executed attacker-supplied type constructors.

Attack Vector

Exploitation requires local code execution at the same integrity level as the Greenshot process. An attacker sends a crafted WM_COPYDATA message containing a BinaryFormatter gadget payload to the Greenshot main window handle, obtainable through FindWindow or window enumeration APIs. The primary security value for an attacker is code execution inside a signed, trusted binary, which aids evasion of application control policies enforcing publisher-based allowlists.

text

// Patch reference: src/Greenshot/Helpers/CopyData.cs
// Additional imports added to support validated deserialization
using System.Runtime.Serialization;
using System.Runtime.Serialization.Formatters.Binary;
using System.ServiceModel.Security;
using System.Windows.Forms;
using Greenshot.Base.Core;
using Greenshot.Helpers;
using log4net;

Source: Greenshot commit f5a29a2

Detection Methods for CVE-2025-59050

Indicators of Compromise

Unexpected child processes spawned by Greenshot.exe, especially command shells such as cmd.exe, powershell.exe, or wscript.exe.
Greenshot.exe performing outbound network connections or writing executables to disk outside its normal working directories.
Local processes calling SendMessage or PostMessage with WM_COPYDATA (0x004A) targeting the Greenshot main window.

Detection Strategies

Monitor process lineage for Greenshot.exe spawning interpreters, scripting hosts, or LOLBins inconsistent with normal screenshot workflows.
Alert on Greenshot.exe loading unusual .NET assemblies via System.Runtime.Serialization.Formatters.Binary at runtime.
Hunt for versions of Greenshot.exe at or below 1.3.300 in the environment using software inventory data.

Monitoring Recommendations

Enable Sysmon Event ID 1 (process creation) and Event ID 7 (image load) with rules tracking Greenshot.exe behavior.
Correlate application control (WDAC/AppLocker) audit logs with process activity to detect signed-binary abuse patterns.
Track deployed Greenshot versions through endpoint inventory and flag hosts still running 1.3.300 or earlier.

How to Mitigate CVE-2025-59050

Immediate Actions Required

Upgrade all Greenshot installations to version 1.3.301 or later immediately.
Inventory endpoints for vulnerable versions of Greenshot.exe and prioritize hosts with sensitive users or elevated privileges.
Review application control policies to ensure signed-binary allowlists do not implicitly trust in-process code execution.

Patch Information

The fix is delivered in Greenshot 1.3.301 via commit f5a29a2ed3b0eb49231c0f4618300f488cf1b04d. The patch reorders the WM_COPYDATA handler in src/Greenshot/Helpers/CopyData.cs to validate the sender and channel before invoking any deserialization logic. Full technical details are documented in the Greenshot Security Advisory GHSA-8f7f-x7ww-xx5w.

Workarounds

No vendor-supplied workarounds exist; upgrading to 1.3.301 is the only supported remediation.
As a temporary compensating control, restrict local execution on multi-user systems to reduce the pool of processes that could send WM_COPYDATA to Greenshot.
Uninstall Greenshot on hosts where it is non-essential until patching is complete.

bash

# Verify installed Greenshot version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Greenshot*" } |
  Select-Object DisplayName, DisplayVersion, Publisher

# Any DisplayVersion <= 1.3.300 is vulnerable to CVE-2025-59050