Greenshot, an open‑source Windows screenshot utility, contains a flaw where the application launches explorer.exe without an absolute path. The program accepts a user‑supplied executable name and searches the path hierarchy, allowing a local attacker to place a malicious file with the same name as a legitimate Windows binary in a directory that is searched before explorer.exe. When the user double‑clicks the tray icon, Greenshot opens the folder containing the most recent screenshot, triggering the vulnerable behavior and giving the attacker code execution in the context of the Greenshot process.

The affected product is Greenshot for Windows. Versions 1.3.312 and earlier are vulnerable; no patch was available at publication time, and later releases beyond 1.3.312 are not affected.

The CVSS score of 6.5 reflects moderate severity. EPSS is below 1%, indicating a low likelihood of current exploitation, and the vulnerability is not listed in the CISA KEV catalog. An attacker must have local access to the machine and be able to place a malicious executable in a directory that appears before explorer.exe in the search order. Successful exploitation results in code execution within the Greenshot application’s user context; no escalation to higher privileges is described in the available data.