{"id":"CVE-2026-107042","kind":"vulnerability","aliases":["CVE-2026-107042"],"related":[],"title":"USP Ultimate Screenshot Painter: crafted content URI lets attackers overwrite private files","description":"Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI.","summary":"USP Ultimate Screenshot Painter, an Android app, builds on insecure permissions that let an unauthorized app or attacker move or overwrite files in another user's private storage. The attack works by supplying a crafted content URI to the app.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","other","screenshot-painter"],"not_affected_if":[],"how_to_check":"- Check whether the installed app's versionCode is `240213.009` (unknown whether other versions are affected)","fix":null,"status":"open","published_at":"2026-10-29T16:17:50+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","triaged_at":"2026-10-29T16:32:15+00:00","updated_at":"2026-10-29T16:32:15+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-29T16:32:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"USP Ultimate Screenshot Painter: crafted content URI lets attackers overwrite private files","impact":"medium","summary":"USP Ultimate Screenshot Painter, an Android app, builds on insecure permissions that let an unauthorized app or attacker move or overwrite files in another user's private storage. The attack works by supplying a crafted content URI to the app.","audience":"everyone","category":"other","nicknames":[],"who_cares":["android","screenshot-painter"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker moves or overwrites files in another user's private storage","analyst_note":"Confirm affected versions, whether a fix exists, and whether a user must interact with a crafted URI, using the NVD entry and the vendor's advisory.","how_to_check":"- Check whether the installed app's versionCode is `240213.009` (unknown whether other versions are affected)\n- unknown for further checks; the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Users of USP Ultimate Screenshot Painter versionCode 240213.009 on Android are the affected group according to the description. The sources do not say which other versions, configurations, or devices are affected, or whether a fixed version exists.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":4096,"output_tokens":500,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107042':15A,18A '-2026':14A,17A '240213.009':72C 'allow':73C 'android':19B,29B 'anoth':47B,82C 'app':30B,39B,63B 'attack':9A,41B,53B,75C 'build':31B 'content':6A,59B,91C 'craft':5A,58B,90C 'cve':13A,16A 'file':12A,45B,80C 'insecur':33B,64C 'let':8A,36B 'move':42B,77C 'overwrit':10A,44B,79C 'painter':4A,23B,27B,70C 'permiss':34B,65C 'privat':11A,50B,85C 'screenshot':3A,22B,26B,69C 'screenshot-paint':21B 'storag':51B,86C 'suppli':56B,88C 'ultim':2A,25B,68C 'unauthor':38B,74C 'uri':7A,60B,92C 'user':48B,83C 'usp':1A,24B,67C 'versioncod':71C 'via':87C 'work':54B","nicknames":[],"mitigations":[],"who_affected":"Users of USP Ultimate Screenshot Painter versionCode 240213.009 on Android are the affected group according to the description. The sources do not say which other versions, configurations, or devices are affected, or whether a fixed version exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":null,"first_public_at":"2026-10-29T16:17:50+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107042","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107042","severity":null,"published_at":"2026-10-29T16:17:50+00:00","modified_at":"2026-10-29T16:17:50+00:00","first_seen_at":"2026-10-29T16:25:55+00:00","fetched_at":"2026-10-29T16:25:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}