FastStone Image Viewer CVE-2026-116463

Exploitation requires a victim to open an attacker-crafted image file in FastStone Image Viewer (versions up to 8.5); the flaw lives in the Box-Average Downsampler engine (function FUN_0062d96c), so the malicious image must exercise that downsampling path. The CVSS vector's UI:P confirms required user interaction, which is the primary limiting factor - there is no remotely reachable service and no automatic/unattended trigger. No special product configuration is indicated; default installations that open the crafted file are affected. Impact is bounded (low confidentiality/availability), so the realistic outcome is limited memory disclosure or an application crash rather than code execution.

This is a medium-severity issue (CVSS 4.0 base 5.3) that does not rise to a high real-world priority. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) shows low impact across confidentiality, integrity and availability and - critically - requires user interaction (UI:P), meaning a victim must open a crafted image in the viewer; the 'network' attack vector reflects remote delivery of a malicious file rather than a directly remotely-reachable service. The vuln.today decision label is 'this_month', not act_now or emergency, consistent with a non-urgent triage posture. No EPSS score, no CISA KEV listing, and no confirmed public exploit code are present in the input, so there is no signal of active or imminent exploitation. The single intelligence source is VulDB; there is no corroborating NVD, vendor, or CISA enrichment, and the vendor was contacted but did not respond, so no patch is referenced. Bottom line: a low-impact client-side out-of-bounds read in desktop image-viewer software - real but low urgency; treat as routine patch-when-available rather than a priority.

An attacker crafts a malformed image file that triggers the out-of-bounds read in the Box-Average Downsampler Engine (function FUN_0062d96c) and delivers it to a victim via email, web download, or a shared drive. When the victim opens the file in FastStone Image Viewer (up to 8.5), the flawed downsampling routine reads memory outside the intended buffer, potentially disclosing a small amount of adjacent process memory or crashing the application. Exploitation requires the user to open the malicious file (UI:P); no public exploit code is identified at time of analysis.