CVE-2026-107042
Description
A flaw was found in USP Ultimate Screenshot Painter due to insecure permissions. An attacker can exploit this vulnerability by supplying a crafted content Uniform Resource Identifier (URI). Successful exploitation allows the attacker to move or overwrite files stored in another user's private storage, leading to unauthorized file modification and loss of data integrity.
Statement
This vulnerability is rated as having Moderate severity because unauthorized file modifications are confined to local application storage and do not permit arbitrary code execution. Red Hat products are not affected by this flaw, as USP Ultimate Screenshot Painter is an Android mobile application and is not included or supported in any Red Hat enterprise offerings.
Understanding the Weakness (CWE)
Integrity,Confidentiality
Technical Impact: Read Files or Directories
The application can operate on unexpected files, such as system files or configuration files. Confidentiality is violated when the targeted filename is not directly readable by the attacker.
Integrity,Confidentiality,Availability
Technical Impact: Modify Files or Directories; Execute Unauthorized Code or Commands
The application can operate on unexpected files. This may violate integrity if the filename is written to, or if the filename is for a program or other form of executable code.
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (Other)
The application can operate on unexpected files. Availability can be violated if the attacker specifies an unexpected file that the application modifies. Availability can also be affected if the attacker specifies a filename for a large file, or points to a special device or a file that does not have the format that the application expects.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
