Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

ScreenToGif can run malicious code from its folder

CVE-2026-33156 · published 7 months ago
Summary

ScreenToGif versions up to 2.42.1 may load a library file from the same folder it is started in, even if that folder can be written to by any user. An attacker could place a fake library there and cause the program to execute unwanted code with the user’s rights. Until a fix is released, run ScreenToGif only from trusted locations or use a version that is not portable.

Original advisory text
DLL Sideloading in ScreenToGif
ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32 directory, allowing arbitrary code execution in the user's context. This is especially impactful because ScreenToGif is primarily distributed as a portable application intended to be run from user-writable locations. At time of publication, there are no publicly available patches.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-426Untrusted Search Path
CWE-427Uncontrolled Search Path Element
Timeline
Published20 Mar 2026
Updated4 Nov 2026
First seen20 Mar 2026
Sources
CVE-2026-33156 · NVD
CVE-2026-33156 · OSV
GHSA-3fmj-j696-9mg2 · GHSA
Track software like this
Free during beta