Flameshot EUVD-2026-44675

Exploitation requires a local, unprivileged attacker account on the same physical or virtual machine as the victim user - remote exploitation is not possible. The victim must actively invoke the 'Open With' feature in Flameshot, which is a deliberate user action beyond simply taking a screenshot; passive screenshot capture does not trigger the vulnerable code path. The attacker must win a timing race between the predictable temp path being computed and Flameshot writing to it; the predictable naming convention makes this race reliably winnable. File overwrite is strictly limited to files writable by the victim user - the attacker cannot affect root-owned files, other users' files, or system resources outside the victim's permission scope. Limiting factors: requires coexistence of an untrusted local user and a Flameshot user on the same system, active use of a non-default feature, and successful race timing.

The CVSS 4.0 base score of 5.1 (AV:L/AC:L/AT:N/PR:N/UI:N) reflects local-access-only exploitation with no privileges required, mapping to a medium severity tier. Real-world risk is significantly constrained: the attacker must already possess a local shell on the same machine as the victim, and must win a timing race - though the deterministic filename pattern makes the race relatively reliable in practice. Impact is bounded to files writable by the victim user (VI:L/VA:L per CVSS 4.0), so privilege escalation to root is not directly achievable through this vector alone. No KEV listing exists and no EPSS data was provided in the input. The primary risk amplifier is multi-user shared environments (shared Linux servers, university systems, virtual desktop infrastructure) where untrusted local users and Flameshot users coexist; single-user desktop deployments face negligible practical risk since the local attacker would already have equivalent file-write access. The provided CVSS 4.0 vector asserts UI:N and AT:N, but the description implies both victim interaction (the victim must invoke 'Open With') and a timing-dependent condition (the race window) - these metrics appear optimistic and may overstate ease of exploitation.

A local unprivileged attacker on a shared Linux system monitors the system temp directory for Flameshot's predictable screenshot filename pattern, then races to replace it with a symlink pointing to a victim-writable target such as ~/.ssh/authorized_keys or ~/.bashrc. When the victim invokes 'Open With' on a screenshot, Flameshot follows the symlink and overwrites the target file with raw PNG binary data, corrupting or replacing its contents - potentially disrupting authentication, application configuration, or other user-owned resources.