CVE-2025-63916

Katalog CVE

CVSS 8.1 · High EPSS 1,6%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada luotengyuan myscreentools. Skor CVSS 3.1 8.1 (High) menurut CISA ADP.

Deskripsi (NVD)

MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supplied file paths before passing them to cmd.exe, allowing attackers to execute arbitrary system commands with the privileges of the user running the application. The vulnerability exists in the CMD() function within GIFSicleTool\Form_gif_sicle_tool.cs, which constructs shell commands by concatenating unsanitized user input (file paths) and executes them via cmd.exe.

Rincian

Terbit di NVD

17 November 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/cydtseng/Vulnerability-Research/blob/main/myscreentools/OSCommandInjection-GifCompression.m... exploit · mitigasi · advisory pihak ketiga
• https://github.com/luotengyuan/MyScreenTools/blob/master/GIFSicleTool/Form_gif_sicle_tool.cs product
• https://github.com/luotengyuan/MyScreenTools/tree/master product