What is the CVSS score of CVE-2026-101203?

CVE-2026-101203 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P. EPSS exploitation probability: 0.2%.

FastStone Image Viewer CVE-2026-101203

EUVD-2026-88556 LOW

Out-of-bounds Write (CWE-787)

2026-09-28 VulDB

GHSA-r4jh-4qvm-8mh5

Windows Buffer Overflow Memory Corruption Image Viewer Faststone

2.1

CVSS 4.0 · Vendor: VulDB

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Craft malicious 1bpp RLE image
Delivery

Deliver file to victim
Exploit

Victim opens file in FastStone
Execution

OOB write in RLE decoder
Impact

Memory corruption / possible code execution

Vulnerability Assessment

Weakness	CWE CWE-787 ASVS 5.0 V15 - Secure Coding and Architecture Bounds checking, write limits MITRE ATT&CK 2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires the victim to open or preview a crafted image processed by FastStone Image Viewer's 1bpp RLE decoder (CVSS UI:P confirms required user interaction). No authentication or privileges are needed on the attacker side, but there is no server-side remote reach - the attacker must induce the target to open the malicious file, so social engineering or a drive-by download is a prerequisite. Affected versions are FastStone Image Viewer up to and including 8.3; the software runs only on Windows. LIMITING FACTORS: mandatory user interaction, client-side-only trigger, consumer desktop deployment, and absence of any linked working exploit. AGGRAVATING FACTOR: no vendor patch exists (vendor unresponsive).
Impact	Signals are mixed but converge on LOW-to-MEDIUM real-world priority. The only CVSS provided is VulDB's CVSS 4.0 base 5.3 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) with exploit-maturity E:P (Proof-of-Concept) - no CVSS 3.1 vector was supplied. The AV:N rating is VulDB's convention for malicious-file delivery, but this is functionally a client-side file-parsing bug: exploitation REQUIRES a victim to open a crafted image (UI:P), so it is not remote-unauthenticated in the server sense. Impact is rated only Low across confidentiality/integrity/availability, which understates the potential of a CWE-787 out-of-bounds write (memory corruption in a decoder can escalate toward code execution), but VulDB conservatively caps it at Low - likely reflecting a crash/limited-corruption PoC rather than a demonstrated RCE. No EPSS score, NOT in CISA KEV, and no public exploit link is provided; the E:P flag asserts proof-of-concept maturity but no PoC artifact is referenced. The vendor (FastStone) was contacted and did not respond, so there is NO patch available - a notable exposure factor. Net: this is a plausible-but-unproven memory-safety bug in consumer desktop software, gated by user interaction, with no patch and no confirmed exploitation. It is a moderate-severity hygiene issue, not an urgent incident-response priority. CONFLICT to note: the E:P maturity claim is not backed by a linked PoC in the provided references.
Exploit ScenarioDerived	An attacker crafts a malformed 1bpp RLE-encoded image (e.g., a BMP-family file) and delivers it to a victim via email, download, or a website. When the victim opens or previews the file in FastStone Image Viewer (≤8.3), the RLE decoder performs an out-of-bounds write, corrupting memory. VulDB assigns exploit maturity E:P (proof-of-concept), but no public exploit artifact is linked in the provided references.

Monitor Track and reassess. Why: LOW severity (CVSS 0.1-3.9).

No patch listed yet 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 28, 2026

Out-of-bounds write in FastStone Image Viewer through 8.3 lets an attacker corrupt memory - and potentially achieve code execution - when a victim opens or previews a crafted 1bpp RLE image, with impact rated Low across confidentiality, integrity, and availability (CVSS v3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L). The vulnerable component is the viewer's 1bpp RLE decoder, reachable remotely only through user-initiated file opening, so exploitation requires social engineering or a drive-by download against Windows desktop users rather than any server-side reach; the CVSS v4.0 vector carries an exploit-maturity metric of Proof-of-Concept (E:P), meaning publicly available exploit code exists per that metric, although the independent assessment found no linked working exploit and the issue is not listed in CISA KEV. The vendor was contacted early but did not respond and no patch is available, so priority is LOW-to-MEDIUM with risk mitigated primarily by user-interaction requirements, client-side-only triggering, and consumer desktop deployment.

RemediationAI

No vendor-released patch was identified at time of analysis, so remediation must rely on compensating controls. The most effective is to prevent untrusted image files from reaching the decoder: strip or quarantine image attachments at the mail gateway, block downloads of image files from untrusted origins, and enforce Mark-of-the-Web/SmartScreen so users see a warning before opening files from the internet; the trade-off is reduced convenience and false positives on legitimate image traffic. Where FastStone is not essential, use an alternative viewer whose decoder is maintained, or run FastStone inside a sandbox/AppContainer (e.g., Windows Sandbox, a low-privilege VM, or an isolated user account) so a successful out-of-bounds write cannot touch the host; the cost is slower workflow and file-transfer friction. Organizations can also remove file-type associations (.pcx, .bmp, .ico/.cur and similar 1bpp/RLE-capable formats) from FastStone so double-clicking does not auto-launch the vulnerable parser, or restrict the application via AppLocker/WDAC to trusted directories and users, acknowledging that these measures reduce functionality for legitimate image work. Because the CVSS v4.0 exploit-maturity metric is Proof-of-Concept (E:P) - while the independent assessment identified no linked working exploit - hardening should be prioritized over emergency response, but monitoring for crash reports and anomalous child processes spawned by FastStone is a useful detection backstop. Continue to watch the VulDB entries (https://vuldb.com/vuln/411012) for a vendor fix; no exact patched version can be cited from the available data, and re-testing any future release remains necessary because the vendor never acknowledged the report.

Affected VersionsENISA

Image Viewer 8.3

Image Viewer 8.2

Image Viewer 8.1

Image Viewer 8.0

Affected Packages

euvd image_viewer no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The affected code is the 1 bit-per-pixel run-length-encoding (RLE) decoder inside FastStone Image Viewer, a component that decompresses monochrome run-length-encoded image data (as used by formats such as PCX and other 1bpp bitmap variants). RLE decoding expands compact run/length pairs into full raster lines, so a decoder must validate run counts, pixel offsets, and stride arithmetic against the size of the destination buffer; the weakness here is CWE-787 (Out-of-bounds Write), meaning the decoder writes decoded pixels past the end of an allocated buffer because bounds checks on the run length or destination offset are insufficient or absent. The specific function is not disclosed ('unknown function' per the reporting advisory), and the CPE cpe:2.3:a:faststone:image_viewer:*:*:*:*:*:*:*:* applies to all tracked versions up to and including 8.3 on Windows. Characteristic consequences of this class are heap or stack corruption that can crash the process (availability impact) and, under the right heap layout, redirect control flow, which is why integrity and confidentiality are also rated Low rather than None; the disclosed CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P with Low VC/VI/VA and no subsequent-system impact) is consistent with a client-side, user-interaction-triggered memory-safety bug of limited but non-trivial severity.

Know when Image Viewer gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulDB) PRIMARY 2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P

vuln.today AI 6.3 MEDIUM

Crafted file delivered remotely (AV:N) but victim must open it (UI:R); no privileges needed; OOB write yields limited memory corruption rather than confirmed full compromise, so C/I/A each Low.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

None

User Interaction

Passive

Vulnerable system: Confidentiality

Low

Vulnerable system: Integrity

Low

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Severity Changed

Sep 28, 2026 - 22:22 NVD

MEDIUM LOW

CVSS changed

Sep 28, 2026 - 22:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipulation leads to out-of-bounds write. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Threat Intelligence Overview

EPSS Score

0.2%

Top 87% exploitable

Prevalence

Medium

widely-used freeware desktop image viewer, consumer footprint, no enterprise base

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity LOW

CISA KEV No

Public POC No

EPSS 0.2%

Patch available No

Active threat No

Deciding rule

LOW severity (CVSS 0.1-3.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Defer

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact· derived

Low

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +10

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Buffer Overflow HIGH

A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.

Memory Corruption HIGH

Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.