CVE-2023-34634: Remote Code Execution in Greenshot

Greenshot 1.2.10 and earlier versions contain an insecure deserialization vulnerability (CVE-2023-34634) that enables arbitrary code execution. The flaw is exploited when a user opens a crafted .greenshot file, causing uncontrolled execution of .NET code. Greenshot is a widely-used screenshot tool in corporate environments, making this vulnerability relevant to system administrators and IT teams.

The vulnerability is rated CVSS 7.8 (high severity), confirmed by official sources. Although first reported on August 1, 2023, public GitHub repositories declared exploit code for CVE-2023-34634 on November 2, 2026. This recent activity signals renewed interest in exploiting the flaw, though it does not constitute a zero-day discovery. The patching status and mitigation posture remain critical for affected environments.

System administrators and IT teams must prioritize upgrading Greenshot beyond version 1.2.10. Implement access controls on .greenshot files and monitor opening of .greenshot files from untrusted sources. Where immediate patching is not feasible, limit Greenshot usage to trusted environments only and enforce provenance checks on .greenshot files. Review endpoint logs for signs of suspicious file openings and process execution following .greenshot file interaction.