« Volver al listado

CVE-2026-33156

Estado: AnalizadaAlta (7.8)—

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32 directory, allowing arbitrary code execution in the user's context. This is especially impactful because ScreenToGif is primarily distributed as a portable application intended to be run from user-writable locations. At time of publication, there are no publicly available patches.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Requiere interacción del usuario (UI:R) al ejecutar el portable desde directorio escribible. DLL sideloading (CWE-426/427) permite inyección de código arbitrario mediante T1574.007, posibilitando ejecución de comandos (T1059).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionAuditRestrict Web-Based ContentRestrict File and Directory PermissionsPrivileged Account ManagementLimit Software Installation

Tecnologías afectadas (1)

Screentogif — Screentogif

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-33156",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33156",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-03-26T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "NickeManarin",
          "product": "ScreenToGif",
          "versions": [
            {
              "status": "affected",
              "version": "<= 2.42.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-03-20T21:17:16.070",
  "references": [
    {
      "url": "https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        },
        {
          "lang": "en",
          "value": "CWE-427"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32 directory, allowing arbitrary code execution in the user's context. This is especially impactful because ScreenToGif is primarily distributed as a portable application intended to be run from user-writable locations. At time of publication, there are no publicly available patches."
    },
    {
      "lang": "es",
      "value": "ScreenToGif es una herramienta de grabación de pantalla. En versiones desde la 2.42.1 y anteriores, ScreenToGif es vulnerable a la carga lateral de DLL a través de version.dll. Cuando el ejecutable portátil se ejecuta desde un directorio escribible por el usuario, carga version.dll desde el directorio de la aplicación en lugar del directorio System32 de Windows, permitiendo la ejecución de código arbitrario en el contexto del usuario. Esto es especialmente impactante porque ScreenToGif se distribuye principalmente como una aplicación portátil diseñada para ejecutarse desde ubicaciones escribibles por el usuario. En el momento de la publicación, no hay parches disponibles públicamente."
    }
  ],
  "lastModified": "2026-06-17T10:37:02.667",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:screentogif:screentogif:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "09C166C5-125F-4E19-B1A8-A647A44AE43B",
              "versionEndIncluding": "2.42.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}