---
id: "CVE-2026-107042"
kind: "vulnerability"
aliases: ["CVE-2026-107042"]
title: "USP Ultimate Screenshot Painter: crafted content URI lets attackers overwrite private files"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["android", "other", "screenshot-painter"]
not_affected_if: []
published_at: "2026-10-29T16:17:50+00:00"
first_seen_at: "2026-10-29T16:25:55+00:00"
updated_at: "2026-10-29T16:32:15+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107042", "first_seen_at": "2026-10-29T16:25:55+00:00"}]
---

# USP Ultimate Screenshot Painter: crafted content URI lets attackers overwrite private files

USP Ultimate Screenshot Painter, an Android app, builds on insecure permissions that let an unauthorized app or attacker move or overwrite files in another user's private storage. The attack works by supplying a crafted content URI to the app.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the installed app's versionCode is `240213.009` (unknown whether other versions are affected)

## Timeline

- 2026-10-29T16:25:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107042

## From the sources

Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_