Microsoft releases emergency updates to address cropped screengrab privacy flaws

Following the discovery of serious vulnerabilities in the Snipping Tool app for Windows 11 and Snip & Sketch in Windows 10, Microsoft has released out-of-band updates to plug the security holes.

The flaws are similar to the recently discovered aCropalypse bug affecting Pixel mobiles, making it possible to "uncrop" cropped images and potentially expose sensitive information. Having briefly tested updates with Windows Insiders, Microsoft has now made fixes available to all Windows 10 and Windows 11 users.

See also:

• Microsoft is working on a new way for you to clean up the Windows 11 taskbar and system tray
• Microsoft has hidden Cloud PC references in Windows 11 as a hint of future Windows 12 features
• Microsoft fixes serious privacy vulnerability in Windows 11 Snipping Tool... but not for everyone

The vulnerability, tracked as CVE-2023-28303, has been classed as low severity because Microsoft says that the scenarios in which the vulnerabilities could expose data are rare. As all that needs to be done is to save a screenshot in Snipping Tool or Snips & Sketch, crop said image and save it with the same name, the likelihood seems greater than Microsoft would have users believe.

The company explains:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do for this Low severity vulnerability?

The severity of this vulnerability is Low because successful exploitation requires uncommon user interaction and several factors outside of an attacker's control. For an image to be subject to this issue, a user must have created it under specific conditions:

1. The user must take a screenshot, saved it to a file, modify the file (for example, crop it), and then save the modified file to the same location.

2. The user must open an image in Snipping Tool, modify the file (for example, crop it), and then save the modified file to the same location.

Common use cases like copying the image from Snipping Tool or modifying it before saving it are not affected.

For example, if you take a screenshot of your bank statement, save it to your desktop, and crop out your account number before saving it to the same location, the cropped image could still contain your account number in a hidden format that could be recovered by someone who has access to the complete image file. However, if you copy the cropped image from Snipping Tool and paste it into an email or a document, the hidden data will not be copied, and your account number will be safe.

Updates are now available for the affected apps via the Microsoft Store; just ensure that Windows 10's Snip & Sketch is versions 10.2008.3001.0 or later, and in the case of Windows 11, that Snipping Tool versions 11.2302.20.0 or later is installed.

Image credit: VadimVasenin / depositphotos