CVE-2026-16477: MTW CleanShot X, десериализация

Описание

Оригинално описание

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10

Засегнати продукти

• MTW CleanShot X: 4.0.0 преди 4.5.2; 4.6.0 преди 4.6.3; 4.7.0 преди 4.7.8; 4.8.0 преди 4.8.10

Вид слабост

• CWE-502 Десериализация на ненадеждни данни

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-16477
• https://nvd.nist.gov/vuln/detail/CVE-2026-16477
• https://cert.pl/en/posts/2026/10/CVE-2026-16477
• https://cleanshot.com/