Ultimate Screenshot Painter CVE-2026-107042

Requires a co-resident/malicious Android app on the same device that can send a crafted content URI to USP Ultimate Screenshot Painter at versionCode 240213.009 specifically; the vulnerable app must be installed. Exploitation is bounded to moving or overwriting files in another app's private storage (integrity only - no read/disclosure, no availability loss), and is limited to that exact version on Android. The specific exported component or intent handler that processes the URI is not described in the available sources, so the precise trigger is unverified; CVSS PR:N indicates no authentication is required of the attacking app.

Signals conflict and must be read together. The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 7.5, I:H only) implies trivial remote unauthenticated compromise, but the mechanism in the description - 'supplying a crafted content URI' to an Android app - is a cross-app, on-device attack, not a network one; AV:N is almost certainly inaccurate and should read AV:L (verify with vendor/advisory). SSVC reinforces a moderate-but-real posture: Exploitation=poc (not active), Automatable=yes, Technical Impact=partial, yielding the vuln.today 'this_week' priority rather than act_now/emergency. There is no EPSS score and no CISA KEV listing in the input, so there is no evidence of widespread or active exploitation. The impact is integrity-only (file move/overwrite in another app's private storage); confidentiality and availability are unaffected. Net: a legitimate but bounded issue - worth patching this week - whose real-world exposure is further limited by the product being a niche F-Droid Android application, not high-CVSS-equals-crisis. Treat the 7.5 as inflated by the questionable network vector.

A malicious or co-resident app installed on the same Android device crafts a content URI and hands it to USP Ultimate Screenshot Painter (versionCode 240213.009), which acts on it without properly validating permissions, letting the attacker move or overwrite files inside another app's private storage. A public PoC reference exists (GitHub F-Droid advisory); it is not verified as working exploit code. The exact exported component and trigger path are not described in the available sources.