What is the CVSS score of CVE-2026-33156?

CVE-2026-33156 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-33156?

ScreenToGif, a screen recording tool commonly used across the organization, contains a critical DLL sideloading vulnerability that could allow attackers to execute malicious code on affected systems.

How to fix or mitigate CVE-2026-33156?

Within 24 hours: Identify all systems with ScreenToGif installed via endpoint management tools and notify affected users to immediately cease using the application. Within 7 days: Conduct an audit for suspicious .dll files in ScreenToGif directories and review system logs for unauthorized access or privilege escalation attempts on affected machines. Within 30 days: Either uninstall ScreenToGif enterprise-wide and implement approved alternative screen recording solutions, or await vendor patch (if released) and perform immediate deployment with mandatory installation to controlled directories only.

Windows CVE-2026-33156

EUVD-2026-13793 HIGH

Untrusted Search Path (CWE-426)

2026-03-20 GitHub_M

RCE Microsoft Windows

7.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 20:46 euvd

EUVD-2026-13793

Analysis Generated

Mar 20, 2026 - 20:46 vuln.today

CVE Published

Mar 20, 2026 - 20:29 nvd

HIGH 7.8

DescriptionGitHub Advisory

ScreenToGif is a screen recording tool. In versions from 2.42.1 and prior, ScreenToGif is vulnerable to DLL sideloading via version.dll . When the portable executable is run from a user-writable directory, it loads version.dll from the application directory instead of the Windows System32 directory, allowing arbitrary code execution in the user's context. This is especially impactful because ScreenToGif is primarily distributed as a portable application intended to be run from user-writable locations. At time of publication, there are no publicly available patches.

AnalysisAI

ScreenToGif, a widely-used screen recording application, is vulnerable to DLL sideloading attacks through a malicious version.dll file. Versions from 2.42.1 and earlier are affected when the portable executable is run from user-writable directories, which is the primary intended use case for this application. Attackers can achieve arbitrary code execution in the user's context with high impact on confidentiality, integrity, and availability. No public patches are available at the time of disclosure, and no evidence of active exploitation (KEV status) has been reported.

Technical ContextAI

This vulnerability affects ScreenToGif (CPE: cpe:2.3:a:nickemanarin:screentogif:*:*:*:*:*:*:*:*), a portable screen recording utility developed by NickeManarin. The issue stems from CWE-426 (Untrusted Search Path), where the application attempts to load version.dll from its current application directory before checking the secure Windows System32 directory. This violates the principle of DLL search order security, as the Windows API loader searches the application directory first by default. When an attacker can place a malicious version.dll in the same directory as the legitimate ScreenToGif executable, the operating system will load the attacker's DLL instead of the legitimate Windows system DLL. This is particularly critical for ScreenToGif because it is designed and distributed as a portable application meant to run from arbitrary user-writable locations like Downloads folders, USB drives, or desktop directories, making the attack surface significantly larger than traditional installed applications.

RemediationAI

As of the vulnerability disclosure date, no official patches are available from the vendor for this DLL sideloading vulnerability. Users should monitor the GitHub security advisory at https://github.com/NickeManarin/ScreenToGif/security/advisories/GHSA-3fmj-j696-9mg2 for patch announcements and updates. Until a patched version is released, implement the following mitigations: only run ScreenToGif from trusted, write-protected directories where unprivileged users cannot place malicious DLLs (such as Program Files on Windows with proper ACLs); verify the integrity of the application directory before each execution to ensure no unexpected DLL files are present; avoid downloading or running ScreenToGif from untrusted sources or user-writable locations like Downloads folders; and consider using application whitelisting or Windows Defender Application Control policies to prevent unauthorized DLL loading. Organizations should also educate users about the risks of running portable applications from untrusted directories and implement endpoint detection solutions capable of identifying DLL sideloading behaviors.