RCE in Luotengyuan Myscreentools
CVE-2025-63916
MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supplied file paths before passing them to cmd.exe, allowing attackers to execute arbitrary system commands with the privileges of the user running the application. The vulnerability exists in the CMD() function within GIFSicleTool\Form_gif_sicle_tool.cs, which constructs shell commands by concatenating unsanitized user input (file paths) and executes them via cmd.exe.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.
EPSS exploit prediction
EPSS: 0.016 (74.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 74.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
Weakness classification (CWE)
References
- github.com/luotengyuan/MyScreenTools/blob/master/GIFSicleTool/Form_gif_sicle_to… (Product)
- github.com/luotengyuan/MyScreenTools/tree/master (Product)
- github.com/cydtseng/Vulnerability-Research/blob/main/myscreentools/OSCommandInj… (Exploit, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2025-63916?
- CVE-2025-63916 is a high-severity vulnerability in Luotengyuan Myscreentools, classified under OS Command Injection. CVSS score: 8.1/10. Published 2025-11-17.
- How severe is CVE-2025-63916?
- High severity. CVSS v3 base score is 8.1 out of 10.