Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| MTW | CleanShot X | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Thu, 22 Oct 2026 15:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10 | |
| Title | Insecure Deserialization of .cleanshot Files in CleanShot X | |
| First Time appeared |
Mtw
Mtw cleanshot X |
|
| Weaknesses | CWE-502 | |
| CPEs | cpe:2.3:a:mtw:cleanshot_x:*:*:macos:*:*:*:*:* | |
| Vendors & Products |
Mtw
Mtw cleanshot X |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: CERT-PL
Published:
Updated: 2026-10-22T14:47:26.652Z
Reserved: 2026-07-21T14:22:56.242Z
Link: CVE-2026-16477
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-22T15:17:05.817
Modified: 2026-10-22T15:17:05.817
Link: CVE-2026-16477
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-10-22T16:30:08Z
-
CWE-502
Deserialization of Untrusted Data