Threat reportVulnerabilityTL-2026-4153
CVE-2026-16477: Deserialization of Untrusted Data (CWE-502) in MTW CleanShot X (macOS) leading to code execution via malicious .cleanshot file
CVE-2026-16477 (TL-2026-4153) is a medium-severity software vulnerability, first published 2026-10-22. It has no confirmed attribution, affects MTW CleanShot X (macOS), references 1 CVE (CVE-2026-16477), maps to 5 MITRE ATT&CK techniques (T1005, T1059, T1203), and is covered by 9 detection rules and 9 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 9Indicators of compromise
Key facts for TL-2026-4153
- Threat ID
- TL-2026-4153
- Severity
- MEDIUM
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, news - media, education, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 9
How CVE-2026-16477 works
CERT Polska reports a CWE-502 deserialization vulnerability in MTW CleanShot X for macOS (4.0.0 through 4.5.2). Opening a crafted .cleanshot project file executes an attacker payload during parsing, running code as the current user. The vendor shipped security updates 4.5.2, 4.6.3, 4.7.8 and 4.8.10 on 2026-07-21.
CVE-2026-16477 is a deserialization of untrusted data weakness (CWE-502) in CleanShot X for macOS, developed by MTW. The editable .cleanshot project format was introduced in CleanShot X 4.0 (2021-12-13) and lets users save annotated screenshots as projects that can be reopened and edited. According to the CERT Polska advisory (published 2026-10-22), a specially crafted .cleanshot file carries a payload that is executed automatically during parsing, resulting in arbitrary code execution in the context of the current user.
Exploitation requires user interaction: the victim must open an attacker-supplied .cleanshot file obtained through some untrusted delivery channel (the advisory refers to 'untrusted file delivery' without naming a specific channel). No network-reachable attack surface is described. Code runs with the privileges of the logged-in user, not root.
The vendor changelog (cleanshot.com/changelog) lists versions 4.5.2, 4.6.3, 4.7.8 and 4.8.10, all dated 2026-07-21 and each labelled 'Important security update recommended for all users'. These are parallel fixes across the 4.5, 4.6, 4.7 and 4.8 release branches. This explains why the advisory lists 4.5.2 as both the upper end of the affected range and a fixed version: the affected range most likely means releases before the fix on each branch. The advisory text does not state this, so it is an analyst inference. Users should update to the latest release on whichever branch they run.
The advisory does not provide a CVSS score. The CVE.org page and the NVD API returned no usable record at research time (NVD returned zero results). The advisory reports no CISA KEV listing, no public proof-of-concept, no in-the-wild exploitation, no IOCs and no attribution. The discoverer is credited as Dharan24. Severity MEDIUM is analyst-assigned, reflecting the required user interaction and current-user privilege. BeaconBeagle was not queried because the sources contain no network IOCs.
MITRE ATT&CK techniques used in TL-2026-4153
Collection
Execution
T1059 Command and Scripting Interpreter; T1203 Exploitation for Client Execution; T1204.002 User Execution: Malicious File
Initial Access
Affected products and versions in CVE-2026-16477
- MTW — CleanShot X (macOS)
Vulnerable versions: 4.0.0 through 4.5.2 (per CERT Polska; range boundary overlaps the 4.5.2 fixed version)
Fixed in: 4.5.2; 4.6.3; 4.7.8; 4.8.10
Remediation for CVE-2026-16477
Patches
- CleanShot X 4.5.2, 4.6.3, 4.7.8 and 4.8.10 (vendor releases dated 2026-07-21)
Immediate actions
- Update CleanShot X to the latest release on the branch in use: 4.5.2, 4.6.3, 4.7.8 or 4.8.10 (or newer)
- Do not open .cleanshot project files from untrusted or unverified senders
Workarounds
- Avoid opening externally sourced .cleanshot files until patched
- Block or quarantine .cleanshot attachments at email and web gateways where not business-required
Longer-term hardening
- Inventory macOS endpoints running CleanShot X and enforce minimum version via MDM
- Monitor for unexpected child processes spawned by the CleanShot X application
- Apply least privilege for macOS user accounts so current-user code execution has limited reach
CVEs associated with CVE-2026-16477
Weaknesses (CWE) in CVE-2026-16477
Timeline of CVE-2026-16477
- CleanShot X 4.0 introduces the editable .cleanshot project file format, the parser of which is the affected attack surface.
- MTW releases CleanShot X 4.8.10, labelled an important security update, together with macOS Golden Gate compatibility and a Tahoe dialog focus fix.
- MTW releases CleanShot X 4.7.8, labelled an important security update recommended for all users.
- MTW releases CleanShot X 4.6.3, labelled an important security update recommended for all users.
- MTW releases CleanShot X 4.5.2, labelled an important security update recommended for all users.
- CERT Polska publishes the advisory for CVE-2026-16477, crediting Dharan24 and listing affected versions 4.0.0 to 4.5.2 and fixed versions 4.5.2, 4.6.3, 4.7.8 and 4.8.10.
Sources cited for CVE-2026-16477
- CERT Polska: Vulnerability in MTW CleanShot X software (CVE-2026-16477)
- CVE record CVE-2026-16477
- NVD API query for CVE-2026-16477
- CleanShot X Changelog (security updates 4.5.2, 4.6.3, 4.7.8, 4.8.10)
- CERT Polska Coordinated Vulnerability Disclosure
- 9to5Mac: CleanShot X launches own file format with new update (.cleanshot introduction)
- CWE-502: Deserialization of Untrusted Data
Detection coverage for TL-2026-4153
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4153 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.