What is the CVSS score of CVE-2026-101202?

CVE-2026-101202 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.2%.

FastStone Image Viewer CVE-2026-101202

EUVD-2026-88510 LOW

Out-of-bounds Write (CWE-787)

2026-09-28 VulDB

GHSA-r2x9-h2mc-2vpv

Windows Buffer Overflow Memory Corruption Image Viewer Faststone

2.1

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious TGA file
Delivery

Deliver via email/web/download
Exploit

Victim opens image in FastStone
Execution

Trigger out-of-bounds write in TGA handler
Impact

Corrupt process memory / crash or potential code exec

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires a user of FastStone Image Viewer (versions up to 8.3) to open or preview an attacker-crafted TGA image file that triggers the flaw in the TGA Image Handler - the CVSS UI:P/UI:R requirement is the primary limiting factor. There is no authentication involved (it is a local desktop application, not a service), and no special non-default configuration is needed beyond the affected version handling a TGA file. Because no vendor patch is confirmed available, all installations up to 8.3 remain exposed until an updated build is released or the affected file type is avoided.
Impact	This is a moderate-severity memory-corruption bug (CWE-787 out-of-bounds write) in FastStone Image Viewer's TGA image handler, rated CVSS 4.0 5.3 by VulDB. The vector (AV:N/AC:L/AT:N/PR:N/UI:P) treats the flaw as network-reachable, but the 'remote' label is the standard VulDB convention for file-parsing bugs - actual exploitation requires the victim to open an attacker-crafted TGA file (UI:P), so this is really a client-side, user-interaction-dependent issue rather than a remotely-triggerable service vulnerability. The E:P flag in the CVSS vector indicates proof-of-concept exploit code exists, so publicly available exploit code exists; however, there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. Impact is capped at Low across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), which suggests the OOB write yields limited corruption or a crash rather than confirmed reliable code execution - the description does not claim arbitrary code execution. The vendor was contacted but did not respond and no patch is confirmed available, which raises the practical exposure window. Net: a real but low-to-medium priority desktop-client issue, not a high-urgency remotely-exploitable flaw despite the AV:N vector.
Exploit ScenarioDerived	An attacker crafts a malicious TGA image file and delivers it via email, a download, or a website, then lures a FastStone Image Viewer user into opening or previewing it. Parsing the malformed TGA triggers an out-of-bounds write in the image handler, causing memory corruption that at minimum crashes the application and could potentially be leveraged toward code execution. Proof-of-concept exploit code is referenced by the reporter (VulDB, E:P), but no reliable weaponized exploit or active exploitation is confirmed.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 28, 2026

Out-of-bounds write in FastStone Image Viewer up to version 8.3 allows remote attackers to corrupt memory when a user opens or previews a crafted TGA image file. The vulnerability requires user interaction (UI:P/UI:R) and is rated CVSS 4.0 5.3 (moderate severity). Publicly available exploit code exists (indicated by E:P in the CVSS vector), but no evidence of active exploitation in the wild; the vendor was contacted but did not respond, and no patch is available.

RemediationAI

No vendor patch is available at this time; the vendor did not respond to disclosure. As a compensating control, avoid opening or previewing TGA image files from untrusted sources. If TGA files are not essential, consider disassociating the .tga file extension from FastStone Image Viewer or using an alternative viewer that does not have this vulnerability. Restrict user ability to open files from email or web downloads directly in the viewer. Monitor the VulDB advisory (https://vuldb.com/vuln/411011) for updates. Trade-off: avoiding TGA files may disrupt workflows that rely on that format.

Affected VersionsENISA

Image Viewer 8.2

Image Viewer 8.1

Image Viewer 8.0

Image Viewer 8.3

Affected Packages

euvd image_viewer no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

FastStone Image Viewer is a Windows-based image viewer that supports various formats including TGA. The flaw resides in the TGA Image Handler, specifically an unknown function that processes TGA image files, leading to an out-of-bounds write (CWE-787). This memory corruption can be triggered when a user opens a malicious TGA file, potentially leading to limited code execution or denial of service (CVSS impact: C:L/I:L/A:L). The attack vector is network (AV:N) because the file can be delivered via email or web, but exploitation requires user interaction (UI:P/UI:R). The CPE cpe:2.3:a:faststone:image_viewer:*:*:*:*:*:*:*:* indicates all versions are potentially affected, though the vulnerability is confirmed up to 8.3. No authentication is required, and default configuration is sufficient for exploitation.

Know when Image Viewer gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

vuln.today AI 6.3 MEDIUM

Malicious file is delivered remotely (AV:N) but the victim must open it (UI:R); impacts are limited to partial memory corruption/crash, so C/I/A each Low, not High.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Sep 28, 2026 - 22:22 NVD

MEDIUM LOW

CVSS changed

Sep 28, 2026 - 22:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipulation can lead to out-of-bounds write. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Threat Intelligence Overview

EPSS Score

0.2%

Top 87% exploitable

Prevalence

Medium

popular Windows freeware image viewer, common on desktops but not enterprise-ubiquitous

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Low

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +10

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.