This month, for example, the tech company addressed a number of 75 CVEs, some of them being under active exploitation in the wild. Now, users found another weak spot in Microsoft’s defense and have posted warnings about it all over social media platforms. Did you think using an innocent app such as Snipping Tool was nothing to worry about? Well, you might want to rethink that, as recent information confirms the exact opposite.

Be careful when using the Windows 10&11 Snipping Tool

Yes, we are talking about a newly revealed issue in Microsoft’s image-snipping tools in both Windows 10 and 11, that has been just discovered. In fact, this discovery was made by one of the people who first reported on a similar problem in Google’s Pixel screenshot tool Markup. You should know that the reverse engineering researcher David Buchanan posted his findings earlier today on his Twitter account. If you didn’t quite get the bigger picture yet, allow us to explain. The post shows that when the user took a screenshot with the Windows 11 Snipping Tool and then saved it, then he could crop the image, save the image to the same file, and show that the cropped data hasn’t been deleted after all. Windows Snipping Tool is vulnerable to Acropalypse too. An entirely unrelated codebase. The same exploit script works with minor changes (the pixel format is RGBA not RGB) Tested myself on Windows 11 https://t.co/5q2vb6jWOn pic.twitter.com/ovJKPr0x5Y — David Buchanan (@David3141593) March 21, 2023 In more common terms, this vulnerability means that someone could actually bring back the data from the part of the image that was cropped. And, yes, this can be achieved in mostly the same way the Pixel-based cropped image could be also recovered. The post’s author also stated that the same exploit script works with minor changes, as the pixel format is RGBA and not RGB.  What is more concerning is what he actually added in a later post, in which he specified that the same issue is found with Microsoft’s Snip & Sketch tool included with Windows 10. What’s important and also interesting at the same time here is that, apparently, this doesn’t happen with the original Windows 10 Snipping Tool. — David Buchanan (@David3141593) March 21, 2023 Please keep in mind that, in theory, these exploits could be used by hackers to reveal previously cut-out sensitive information in images, like passwords, credit card numbers, bank accounts, and more. Collectively, all these have been dubbed the Acropalypse. Know that Google has since patched this issue in its Pixel phones. However, we are yet to see a post from Microsoft, acknowledging what happened and saying it is currently working on a solution. Have you also found evidence of foul play in the Sniping Tool? Share your experience with us in the comments section below.

Name * Email * Commenting as . Not you? Save information for future comments
Comment

Δ