What is CVE-2025-63916?

CVE-2025-63916 is a high-severity vulnerability in Luotengyuan Myscreentools, classified under OS Command Injection. CVSS score: 8.1/10. Published 2025-11-17.

How severe is CVE-2025-63916?

High severity. CVSS v3 base score is 8.1 out of 10.

RCE in Luotengyuan Myscreentools

CVE-2025-63916

MyScreenTools v2.2.1.0 contains a critical OS command injection vulnerability in the GIF compression tool. The application fails to properly sanitize user-supplied file paths before passing them to cmd.exe, allowing attackers to execute arbitrary system commands with the privileges of the user running the application. The vulnerability exists in the CMD() function within GIFSicleTool\Form_gif_sicle_tool.cs, which constructs shell commands by concatenating unsanitized user input (file paths) and executes them via cmd.exe.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.016 (73.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Luotengyuan Myscreentools
N/a — versions n/a

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

cve@mitre.org (Product)
cve@mitre.org (Product)
cve@mitre.org (Exploit, Third Party Advisory, Mitigation)

Frequently asked questions

What is CVE-2025-63916?: CVE-2025-63916 is a high-severity vulnerability in Luotengyuan Myscreentools, classified under OS Command Injection. CVSS score: 8.1/10. Published 2025-11-17.
How severe is CVE-2025-63916?: High severity. CVSS v3 base score is 8.1 out of 10.