CVE-2026-33156

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33156", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-17T21:17:08.886Z", "datePublished": "2026-03-20T20:29:13.939Z", "dateUpdated": "2026-03-27T03:55:37.536Z"}, "containers": {"cna": {"title": "DLL Sideloading in ScreenToGif", "problemTypes": [{"descriptions": [{"cweId": "CWE-426", "lang": "en", "description": "CWE-426: Untrusted Search Path", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-427", "lang": "en", "description": "CWE-427: Uncontrolled Search Path Element", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2"}], "affected": [{"vendor": "NickeManarin", "product": "ScreenToGif", "versions": [{"version": "<= 2.42.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T20:29:13.939Z"}, "descriptions": [{"lang": "en", "value": "ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32 directory, allowing arbitrary code execution in the user's context. This is especially impactful because ScreenToGif is primarily distributed as a portable application intended to be run from user-writable locations. At time of publication, there are no publicly available patches."}], "source": {"advisory": "GHSA-3fmj-j696-9mg2", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-26T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-33156"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T03:55:37.536Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33156", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-20T21:19:25.727218Z"}}}], "references": [{"url": "https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-20T21:19:59.766Z"}}], "cna": {"title": "DLL Sideloading in ScreenToGif", "source": {"advisory": "GHSA-3fmj-j696-9mg2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "NickeManarin", "product": "ScreenToGif", "versions": [{"status": "affected", "version": "<= 2.42.1"}]}], "references": [{"url": "https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2", "name": "https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32 directory, allowing arbitrary code execution in the user's context. This is especially impactful because ScreenToGif is primarily distributed as a portable application intended to be run from user-writable locations. At time of publication, there are no publicly available patches."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-426", "description": "CWE-426: Untrusted Search Path"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-427", "description": "CWE-427: Uncontrolled Search Path Element"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-20T20:29:13.939Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33156", "state": "PUBLISHED", "dateUpdated": "2026-03-27T03:55:37.536Z", "dateReserved": "2026-03-17T21:17:08.886Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-20T20:29:13.939Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "ScreenToGif", "vendor": "NickeManarin", "versions": [{"status": "affected", "version": "<= 2.42.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:screentogif:screentogif:*:*:*:*:*:*:*:*", "matchCriteriaId": "09C166C5-125F-4E19-B1A8-A647A44AE43B", "versionEndIncluding": "2.42.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32 directory, allowing arbitrary code execution in the user's context. This is especially impactful because ScreenToGif is primarily distributed as a portable application intended to be run from user-writable locations. At time of publication, there are no publicly available patches."}, {"lang": "es", "value": "ScreenToGif es una herramienta de grabaci\u00f3n de pantalla. En versiones desde la 2.42.1 y anteriores, ScreenToGif es vulnerable a la carga lateral de DLL a trav\u00e9s de version.dll. Cuando el ejecutable port\u00e1til se ejecuta desde un directorio escribible por el usuario, carga version.dll desde el directorio de la aplicaci\u00f3n en lugar del directorio System32 de Windows, permitiendo la ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario. Esto es especialmente impactante porque ScreenToGif se distribuye principalmente como una aplicaci\u00f3n port\u00e1til dise\u00f1ada para ejecutarse desde ubicaciones escribibles por el usuario. En el momento de la publicaci\u00f3n, no hay parches disponibles p\u00fablicamente."}], "id": "CVE-2026-33156", "lastModified": "2026-06-17T10:37:02.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33156", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-26T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-20T21:17:16.070", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-426"}, {"lang": "en", "value": "CWE-427"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.42.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ScreenToGif", "source": "cna", "vendor": "NickeManarin"}, "product": "screentogif", "vendor": "nickemanarin"}], "analysis": {"en": {"generated_at": "2026-03-28T05:41:41.385941+00:00", "value": {"mitigation_remediation": ["Move the executable to a non\u2011user\u2011writable directory such as Program Files and use that location to run ScreenToGif.", "Avoid automatically loading DLLs from the application directory by setting an appropriate security policy or using AppLocker.", "Regularly check NickeManarin\u2019s GitHub repository for a patch or update.", "When a patch becomes available, apply it immediately."], "summary": {"action": "Patch ASAP", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The issue affects ScreenToGif versions 2.42.1 and earlier distributed by NickeManarin. The software is typically used as a portable application and is commonly placed in directories writable by users. No specific operating system versions are listed, but the vulnerability is present on any Windows environment where the application runs from a writable path.", "description_and_impact": "This vulnerability allows arbitrary code execution in the user\u2019s context by exploiting DLL sideloading when ScreenToGif runs from a user\u2011writable directory. The executable loads a malicious version.dll from the application directory instead of the Windows System32 directory, permitting an attacker to run arbitrary code with the privileges of the current user. This is a local exploitation that can lead to full compromise of the user account, affecting confidentiality, integrity, and availability of the system.", "risk_and_exploitability": "The CVSS base score is 7.8, indicating a high severity, while the EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be local: an attacker must place a malicious version.dll in the application\u2019s directory to trigger the exploit. However, because many users run the portable executable from personal folders, the risk to individual installations remains significant once the issue is publicized. Currently, no patch exists, so the risk is mitigated only by preventing execution from untrusted directories or waiting for a vendor fix."}}}}, "created": "2026-03-23T09:52:41.211580+00:00", "updated": "2026-03-29T20:28:52.915735+00:00", "vendors": ["nickemanarin", "nickemanarin$PRODUCT$screentogif"]}