FastStone Image Viewer CVE-2026-101205

Exploitation requires the victim to open an attacker-crafted PCX image file in FastStone Image Viewer version 8.3 or earlier; the flaw lives specifically in the product's PCX decoder path. Limiting factors are significant: mandatory user interaction (UI:P - the target must open the malicious file), the client-side desktop nature of the software (despite the AV:N label, there is no listening network service), and the impact ceiling of an out-of-bounds READ (potential crash or limited memory disclosure, not memory corruption leading to code execution). No authentication is involved because this is a local file-parsing operation, not a service.

This is a low-real-risk, high-noise issue despite carrying malware-adjacent tags. The CVSS 4.0 base score is only 2.1, reflecting a client-side, passive-user-interaction trigger (UI:P) with only Low confidentiality/integrity/availability impact from a single out-of-bounds READ in the PCX decoder. There is no KEV listing and no EPSS score provided, so there is no evidence of active or automated exploitation. The vector's E:P (Proof-of-Concept) temporal metric plus VulDB's submission workflow indicates that exploit/PoC material exists, but PoC existence is NOT active exploitation. Note a signal tension: the vector uses AV:N, yet the vulnerability is inherently client-side - it requires a victim to open a crafted PCX file in a desktop image viewer (UI:P), so real-world reach is far narrower than 'network' implies; effectively this behaves like a local file-open flaw. The 'Buffer Overflow' tag also overstates the primitive, which is an OOB read (info-leak/crash), not a write. Net: not a patching priority for most organizations, and no vendor fix exists (vendor was contacted and did not respond).

An attacker crafts a malicious PCX image and delivers it via email, a website, a shared drive, or a file archive; when the victim opens it in FastStone Image Viewer (<=8.3), the PCX decoder reads past the bounds of an allocated buffer. A public proof-of-concept is indicated (E:P), but the outcome is limited to an out-of-bounds read causing a crash or minor information disclosure - not code execution. Exploitation depends entirely on the victim choosing to open the attacker-supplied file.