Cpe:2.3:a:usp:ultimate_screenshot_painter:240213.009:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3auspultimate_screenshot_painter240213.009/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 21:07:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUSP Ultimate Screenshot Painter: Insecure file permission handling (CVE-2026-107042)https://feed.craftedsignal.io/briefs/2026-10-usp-ultimate-screenshot-painter/Thu, 29 Oct 2026 21:07:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-usp-ultimate-screenshot-painter/USP Ultimate Screenshot Painter version 240213.009 contains an insecure permission flaw that allows unauthorized actors to move or overwrite files in private storage via crafted content URIs.USP Ultimate Screenshot Painter, specifically versionCode 240213.009, is vulnerable to an insecure permission issue. An attacker can exploit this flaw by providing a crafted content URI to the application, enabling them to move or overwrite files within the private storage directories of other users. No patch or fixed version has been disclosed by the vendor in the initial advisory.

Impact

Successful exploitation allows for unauthorized modification of sensitive files or data residing in private application storage, potentially leading to data loss or integrity compromise for other users on the same device.

Recommendation

  • Inventory all Android devices currently running USP Ultimate Screenshot Painter version 240213.009.
  • Implement mobile device management (MDM) policies to restrict the application if it is deemed high-risk to the environment.
  • Monitor the vendor's official channels for a security patch addressing CVE-2026-107042 and upgrade immediately upon release.
]]>highadvisory