CVE-2026-33156: ScreenToGif DLL Sideloading RCE Vulnerability

CVE-2026-33156 Overview

CVE-2026-33156 is a DLL sideloading vulnerability affecting ScreenToGif, a popular screen recording tool. In versions from 2.42.1 and prior, the application is vulnerable to DLL sideloading via version.dll. When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32 directory, allowing arbitrary code execution in the user's context.

Critical Impact

This vulnerability enables arbitrary code execution through DLL sideloading when ScreenToGif is run from user-writable locations—the default deployment method for this portable application.

Affected Products

• ScreenToGif versions 2.42.1 and prior
• Portable executable deployments in user-writable directories
• Windows systems running the vulnerable application versions

Discovery Timeline

• 2026-03-20 - CVE CVE-2026-33156 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33156

Vulnerability Analysis

This vulnerability is classified under CWE-426 (Untrusted Search Path), which occurs when an application searches for libraries or executables in directories that may be under attacker control before searching in trusted system locations. The vulnerability is particularly severe in this case because ScreenToGif is primarily distributed as a portable application specifically designed to run from user-writable locations such as the Downloads folder or Desktop.

When the application executes, Windows follows its standard DLL search order. Because ScreenToGif loads version.dll without specifying the full system path, an attacker who places a malicious version.dll in the same directory as the ScreenToGif executable can achieve code execution with the privileges of the user running the application.

Root Cause

The root cause stems from the application's failure to use secure DLL loading practices. Instead of explicitly loading version.dll from the %SystemRoot%\System32 directory using an absolute path, the application relies on the default Windows DLL search order. This search order checks the application's directory before the System32 directory, creating an opportunity for DLL hijacking.

The vulnerability is exacerbated by the application's portable nature—users are expected to run it from user-writable locations where attackers could potentially place malicious DLL files through social engineering, drive-by downloads, or other attack vectors.

Attack Vector

The attack requires local access and user interaction. An attacker must place a malicious version.dll file in the same directory as the ScreenToGif executable before the victim launches the application. Attack scenarios include:

1. An attacker convinces a user to download a "bundled" version of ScreenToGif containing a malicious DLL
2. A malicious DLL is placed in the user's Downloads folder where ScreenToGif may be executed
3. A compromised shared network location hosts both the application and the malicious DLL

When the user executes ScreenToGif, the malicious version.dll is loaded and executed with the user's privileges, potentially allowing persistent access, data exfiltration, or further lateral movement.

The vulnerability involves version.dll being loaded from an untrusted path. When ScreenToGif starts, it attempts to load version.dll following Windows DLL search order. If a malicious DLL with that name exists in the application directory, it will be loaded before the legitimate system DLL. The malicious DLL can then execute arbitrary code within the context of the ScreenToGif process. For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-33156

Indicators of Compromise

• Presence of version.dll files in user-writable directories alongside ScreenToGif.exe
• Unexpected DLL files in Downloads, Desktop, or temporary directories where ScreenToGif may be executed
• Process execution anomalies where ScreenToGif.exe spawns unexpected child processes or network connections
• File hash mismatches for version.dll when compared against legitimate Windows system DLLs

Detection Strategies

• Monitor for DLL loading events where version.dll is loaded from non-system directories using Sysmon Event ID 7 (Image Loaded)
• Implement application whitelisting policies to prevent execution of unsigned or untrusted DLLs
• Deploy endpoint detection and response (EDR) solutions capable of detecting DLL sideloading patterns
• Create YARA rules to detect known malicious DLL payloads that may exploit this vulnerability

Monitoring Recommendations

• Enable Windows Defender Attack Surface Reduction (ASR) rules for blocking untrusted and unsigned processes
• Configure audit policies to log DLL loading events from user-writable directories
• Monitor for file creation events involving version.dll in non-system paths
• Implement behavioral analysis to detect anomalous activity following ScreenToGif execution

How to Mitigate CVE-2026-33156

Immediate Actions Required

• Avoid running ScreenToGif from user-writable directories such as Downloads, Desktop, or temporary folders
• Move ScreenToGif to a protected directory (e.g., C:\Program Files) where standard users cannot write files
• Verify the integrity of any DLL files present in directories containing ScreenToGif
• Consider using alternative screen recording tools until a patch is available

Patch Information

At the time of publication, there are no publicly available patches for this vulnerability. Users should monitor the GitHub Security Advisory for updates on remediation efforts.

Workarounds

• Install ScreenToGif in a directory requiring administrative privileges to modify (e.g., C:\Program Files\ScreenToGif)
• Implement folder permissions that prevent non-administrative users from writing to the ScreenToGif installation directory
• Use Windows Defender Application Control (WDAC) or AppLocker policies to restrict DLL loading from user-writable paths
• Consider running ScreenToGif in a sandboxed environment or virtual machine for sensitive operations

# Move ScreenToGif to a protected directory and restrict permissions
mkdir "C:\Program Files\ScreenToGif"
copy "ScreenToGif.exe" "C:\Program Files\ScreenToGif\"
icacls "C:\Program Files\ScreenToGif" /inheritance:r /grant:r "BUILTIN\Administrators:(OI)(CI)F" /grant:r "BUILTIN\Users:(OI)(CI)RX"