USP Ultimate Screenshot Painter: Insecure file permission handling (CVE-2026-107042)
USP Ultimate Screenshot Painter version 240213.009 contains an insecure permission flaw that allows unauthorized actors to move or overwrite files in private storage via crafted content URIs.
CVE search metadata
CVE search record: CVE-2026-107042. Severity: high. CVSS: 7.5. KEV: no. Product: Ultimate Screenshot Painter (240213.009). Brief: USP Ultimate Screenshot Painter: Insecure file permission handling (CVE-2026-107042). Brief link: https://feed.craftedsignal.io/briefs/2026-10-usp-ultimate-screenshot-painter/
Triage facts
Revision 1- Applicability
- Ultimate Screenshot Painter (240213.009)
- Evidence
- Unknown
- Severity
- High
- Action
- Monitor or close
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 21:07 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
USP Ultimate Screenshot Painter, specifically versionCode 240213.009, is vulnerable to an insecure permission issue. An attacker can exploit this flaw by providing a crafted content URI to the application, enabling them to move or overwrite files within the private storage directories of other users. No patch or fixed version has been disclosed by the vendor in the initial advisory.
Impact
Successful exploitation allows for unauthorized modification of sensitive files or data residing in private application storage, potentially leading to data loss or integrity compromise for other users on the same device.
Recommendation
- Inventory all Android devices currently running USP Ultimate Screenshot Painter version 240213.009.
- Implement mobile device management (MDM) policies to restrict the application if it is deemed high-risk to the environment.
- Monitor the vendor's official channels for a security patch addressing CVE-2026-107042 and upgrade immediately upon release.
Threat Hunt
Identify unauthorized access to internal private storage paths by USP Ultimate Screenshot Painter
Data: Android system logs (logcat) for file access violations, Application sandboxing event logs
Mitigations
Restrict or remove USP Ultimate Screenshot Painter version 240213.009 from corporate-managed mobile devices
CVE-2026-107042