---
id: CVE-2026-16477
title: Insecure Deserialization of .cleanshot Files in CleanShot X
summary: >-
  CleanShot X for macOS insecurely deserializes untrusted data embedded in a
  .cleanshot project file (editable screenshot annotations). Exploitation
  requires an attacker to craft a malicious .cleanshot file, deliver it to the
  target, and h…
severity: high
cvss: 8.4
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L'
cvssSource: cna
cwe:
  - CWE-502
vendor: MTW
product: CleanShot X
affected:
  - cleanshot_x >= 4.0.0 < 4.5.2
  - cleanshot_x >= 4.6.0 < 4.6.3
  - cleanshot_x >= 4.7.0 < 4.7.8
  - cleanshot_x >= 4.8.0 < 4.8.10
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-22T15:23:03.708342Z'
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T19:00:31.571Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-16477'
references:
  - url: 'https://cert.pl/en/posts/2026/10/CVE-2026-16477'
  - url: 'https://cleanshot.com/'
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.373Z'
---

## Overview

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). Exploitation requires an attacker to craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. Users who have never opened a .cleanshot file from an untrusted source are not affected by this vulnerability. This vulnerability was fixed in versions: 4.5.2, 4.6.3, 4.7.8 and 4.8.10

## Affected

- `cleanshot_x >= 4.0.0 < 4.5.2`
- `cleanshot_x >= 4.6.0 < 4.6.3`
- `cleanshot_x >= 4.7.0 < 4.7.8`
- `cleanshot_x >= 4.8.0 < 4.8.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.