CVE-2025-63916
BaseFortify
Publication date: 2025-11-17
Last updated on: 2025-11-18
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| luotengyuan | myscreentools | 2.2.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a critical OS command injection in MyScreenTools v2.2.1.0's GIF compression tool. It occurs because the application does not properly sanitize user-supplied file paths before passing them to the Windows command shell (cmd.exe). As a result, an attacker can inject and execute arbitrary system commands with the same privileges as the user running the application. The issue is located in the CMD() function in the GIFSicleTool\Form_gif_sicle_tool.cs file, where shell commands are constructed by concatenating unsanitized user input.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to execute arbitrary system commands on the affected system with the privileges of the user running MyScreenTools. This could lead to unauthorized access, data theft, system compromise, or further attacks depending on the user's permissions and the commands executed.