Arbitrary Code Execution in Image Compressor Post-Processing

An issue in Lymphatus caesium-image-compressor All versions up to and including commit 02da2c6 allows a local attacker to execute arbitrary code via the shutdownMachine and putMachineToSleep functions in PostCompressionActions.cpp

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-36365 is a critical arbitrary code execution vulnerability in Lymphatus caesium-image-compressor affecting all versions through commit 02da2c6. The flaw exists in the PostCompressionActions.cpp file, specifically within the shutdownMachine and putMachineToSleep functions, where insufficient input validation allows local attackers to execute arbitrary code. This vulnerability is particularly significant because image compression is often considered a trusted, background operation—making it an attractive attack vector for privilege escalation, lateral movement, or persistence mechanisms. Any organization deploying this compressor in production environments, especially on shared systems or in containerized workloads, faces direct risk of compromise.

Casky's 419 mapped security skills leverage Claude AI with extended reasoning to detect the attack patterns underlying this vulnerability across the MITRE ATT&CK framework. Practitioners using Casky would identify suspicious activity aligned with TA0001 (Reconnaissance—unusual process queries or system enumeration preceding the exploit), TA0043 (Reconnaissance—resource discovery patterns as attackers probe for vulnerable compressor instances), and TA0002 (Execution—detection of unexpected child processes, elevated privilege contexts, or system calls spawned from image compression operations). The platform's skills would surface indicators such as abnormal shutdownMachine/putMachineToSleep function calls with crafted parameters, unexpected system-level operations originating from compressor service accounts, and temporal clustering of compression jobs followed by code execution artifacts—enabling practitioners to distinguish legitimate compression workflows from exploitation attempts before compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-36365.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-36365

Casky has 419 skills that investigate the attack patterns behind CVE-2026-36365. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn