CVE-2026-33156

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-33156

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33156.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-33156

Aliases

GHSA-3fmj-j696-9mg2

Published

2026-03-20T20:29:13.939Z

Modified

2026-04-10T05:43:09.255733Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator

Summary

DLL Sideloading in ScreenToGif

Details

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32 directory, allowing arbitrary code execution in the user's context. This is especially impactful because ScreenToGif is primarily distributed as a portable application intended to be run from user-writable locations. At time of publication, there are no publicly available patches.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33156.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-426",
        "CWE-427"
    ]
}

References

Affected packages

Git / github.com/nickemanarin/screentogif

Affected ranges

Type

GIT

Repo

https://github.com/nickemanarin/screentogif

Events

Introduced

Last affected

4ccf787c0843ae585ca8012c5efcf2ba4d2ff463

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.42.1"
        }
    ]
}

Affected versions

2.*

2.1

2.10

2.11

2.12

2.12.1

2.13

2.13.1

2.13.2

2.13.3

2.14

2.14.1

2.15

2.15.1

2.15.2

2.16

2.17

2.17.1

2.18

2.19

2.19.1

2.19.2

2.19.3

2.2

2.20.1

2.20.2

2.20.3

2.21

2.21.1

2.21.2

2.22

2.22.1

2.23.1

2.23.2

2.24

2.24.1

2.24.2

2.25

2.26

2.26.1

2.27

2.27.1

2.27.2

2.27.3

2.28

2.28.1

2.28.2

2.29

2.29.1

2.3

2.3.1

2.3.2

2.30

2.30.1

2.31

2.32

2.32.1

2.33

2.33.1

2.34

2.34.1

2.35

2.35.1

2.35.2

2.35.3

2.35.4

2.36

2.37

2.37.1

2.37.2

2.38

2.38.1

2.39

2.4

2.40

2.40.1

2.41

2.41.1

2.41.2

2.41.3

2.41.4

2.41.5

2.42

2.42.1

2.5

2.6

2.7

2.7.1

2.7.2

2.8

2.8.1

2.9

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33156.json"