CleanShot X patches high-severity deserialization flaw CVE-2026-16477

MTW has released updates for CleanShot X to address a high-severity vulnerability that allows arbitrary code execution on macOS systems. The flaw, tracked as CVE-2026-16477, exists in how the application processes untrusted data embedded within editable screenshot annotation files.

What happened

The vulnerability stems from insecure deserialization within CleanShot X, a macOS utility for screenshot management. According to the National Vulnerability Database record, the application fails to properly validate data contained in .cleanshot project files. These files store editable annotations for screenshots and are processed automatically when opened by the user.

An attacker must craft a malicious .cleanshot file and successfully deliver it to a target. The exploitation chain requires the victim to open this specific file type within the application. Once the file is opened, the application parses the embedded data without adequate security checks.

This parsing process triggers the execution of arbitrary code. The malicious payload runs in the context of the current user. The weakness is classified under CWE-502, which covers insecure deserialization of untrusted data.

Why it matters

The CVSS score of 8.4 indicates a high severity risk for environments using this software. Because the code executes in the user's context, the attacker gains the same privileges as the victim. This is particularly relevant for organizations where employees use CleanShot X for documentation or support tasks.

Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. The attack vector requires the target to open the crafted file. It is not a remote code execution flaw that triggers without user interaction.

Our take on the response

MTW has addressed the issue by releasing patched versions of the software. The vendor provided fixes for four distinct version branches to ensure broad coverage. Users on older or intermediate versions must update to the specific patched release listed for their branch.

• Update to version 4.5.2 if running the 4.5.x branch.
• Update to version 4.6.3 if running the 4.6.x branch.
• Update to version 4.7.8 if running the 4.7.x branch.
• Update to version 4.8.10 if running the 4.8.x branch.

What defenders should look for

Security teams should monitor for unexpected process executions originating from CleanShot X. Check logs for the application spawning child processes that are not standard system utilities. Look for network connections initiated by the screenshot tool to unknown endpoints. Investigate any .cleanshot files received via email or messaging platforms. Verify that all endpoints are running the latest patched versions. Isolate affected machines if suspicious behavior is detected. Review file integrity monitoring alerts for changes to configuration files.

What to do and how to stay safe: CleanShot X

• Verify the installed version of CleanShot X against the patched list provided by the vendor.
• Update the software to version 4.5.2, 4.6.3, 4.7.8, or 4.8.10 depending on the current branch.
• Educate users to avoid opening .cleanshot files from unknown or untrusted sources.
• Monitor endpoint logs for anomalous process creation linked to the application.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the severity of CVE-2026-16477?

The vulnerability is rated as high severity with a CVSS score of 8.4.

Which versions of CleanShot X are affected?

Versions before 4.5.2, before 4.6.3, before 4.7.8, and before 4.8.10 are affected.

Is there a fix available for this vulnerability?

Yes, fixes have been released in versions 4.5.2, 4.6.3, 4.7.8, and 4.8.10.