Loading story…
A high-severity vulnerability (CVE-2025-59050) in Greenshot for Windows allows local attackers to execute arbitrary code via insecure .NET deserialization. The flaw affects versions 1.3.300 and earlier, enabling code execution within the trusted Greenshot.exe process and bypassing application control policies. Users must upgrade to version 1.3.301 immediately, as no workarounds exist and a proof-of-concept exploit is publicly available.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
2 references tracked. Mallory keeps watching after this page renders.
thecyberexpress.com
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability, CVE-2025-50165, was discovered in the Windows Imaging Component (WIC), specifically within the WindowsCodecs.dll library. The flaw arises from the dereferencing of an uninitialized function pointer during the compression and re-encoding of JPEG images with 12-bit or 16-bit color depth, rather than during standard image decoding or rendering. Security researchers from ESET and Zscaler have analyzed the vulnerability, confirming that it could potentially allow remote code execution if a specially crafted JPEG file is processed by a vulnerable application that performs re-encoding, such as during thumbnail creation. Despite the initial classification as a critical remote code execution risk, further technical analysis indicates that real-world exploitation is significantly constrained. Successful exploitation requires a precise set of conditions: the target application must use a vulnerable version of WindowsCodecs.dll and must re-encode, not just display, a malicious JPEG file. Simply opening or viewing a crafted image is insufficient to trigger the vulnerability, reducing the likelihood of mass exploitation. Microsoft has released a patch, and security experts recommend applying it, but the practical risk is lower than originally feared due to the complexity of the attack scenario.
Jun 29, 2026
Microsoft has disclosed a critical 0-day vulnerability in Windows PowerShell, tracked as CVE-2025-54100, which allows attackers to execute arbitrary code on affected systems. The flaw arises from improper neutralization of special elements in PowerShell's command processing, enabling command injection if an attacker can trick a user into running a malicious script or command. Exploitation requires local access and user interaction, but successful attacks can result in privilege escalation and full system compromise, making this vulnerability a significant risk for organizations relying on PowerShell for administration and automation. No official patch is available yet, and Microsoft has urged organizations to apply immediate mitigations and monitor for updates. The vulnerability is rated as 'Important' with a CVSS score of 7.8, and its potential for chaining with other exploits increases its attractiveness to threat actors. Attack vectors include phishing, watering-hole attacks, and supply-chain compromises where PowerShell scripts are abused during software installation or updates. Security teams are advised to remain vigilant and implement recommended mitigations until a patch is released.
Jun 29, 2026
Cursor released security updates for a high-severity vulnerability, tracked as **CVE-2025-54136** and dubbed **MCPoison**, that affects versions earlier than **1.3**. The flaw stems from how the AI code editor handles configuration changes for **MCP (Model Context Protocol) servers**, allowing a trust bypass that can lead to **remote code execution** and, in some cases, full system compromise. Researchers reported that the issue can be triggered through tampered MCP configuration files on a victim machine or through modified files embedded in GitHub repositories opened by developers, creating a path to persistent code execution inside the development environment. Defenders were urged to upgrade Cursor to **version 1.3** immediately and limit the IDE to connections with only trusted MCP servers.
Jul 24, 2026