ScreenToGif DLL Sideloading Vulnerability Allowing Arbitrary Code Execution

A DLL sideloading vulnerability has been identified in ScreenToGif versions through 2.42.1. When the portable executable is executed from a user-writable directory, it improperly loads version.dll from the application directory instead of the Windows System32 directory. This flaw enables arbitrary code execution in the user's context. The vulnerability is particularly concerning because ScreenToGif is mainly distributed as a portable application meant to be run from user-writable locations.

Impact

Exploitation of this vulnerability allows for arbitrary code execution in the user's security context. The executed code can be stealthy, as the malicious DLL can forward application function calls, making it appear as though the application is functioning normally. Additionally, the malicious DLL can persist in the portable application directory.