What is the CVSS score of EUVD-2026-39772?

EUVD-2026-39772 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.5%.

FastStone Image Viewer EUVD-2026-39772

| CVE-2026-30040 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-06-26 cve@mitre.org

GHSA-74rp-5fx4-84m7

RCE Buffer Overflow Heap Overflow

6.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

8.8 HIGH

File-parsing RCE requires victim to open a file (UI:R); arbitrary code execution implies full C:H/I:H/A:H; AV:N because malicious file can be remotely delivered.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 20:10 vuln.today

CVE Published

Jun 26, 2026 - 15:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

A heap overflow in the FSViewer.exe process of FastStone Image Viewer v8.3 allows attackers to cause a execute arbitrary code in the context of the current process via supplying a crafted JPEG 2000 (JP2) file.

AnalysisAI

Heap-based buffer overflow in FastStone Image Viewer v8.3 allows arbitrary code execution when a victim opens a crafted JPEG 2000 (JP2) file, running malicious code in the context of the current user process. The flaw resides in the FSViewer.exe image parsing component and is triggered purely through file interaction, with no authentication or elevated privileges required of the attacker. No public exploit code has been identified at time of analysis and CISA SSVC rates exploitation status as none, though the attack is classified as automatable once file delivery to a target is achieved.

Technical ContextAI

FastStone Image Viewer is a Windows desktop image processing application. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: the JP2 (JPEG 2000) file parser in FSViewer.exe fails to perform adequate bounds checking when allocating or writing to heap memory while processing image data. JPEG 2000 is a complex, multi-layer image format whose parsing routines are historically prone to memory corruption bugs due to variable-length data structures and optional codestream markers. Exploiting a heap overflow for code execution typically involves heap shaping or grooming techniques to position attacker-controlled data at a predictable heap address, then hijacking control flow via an overwritten function pointer or vtable entry. No CPE string was provided in the intelligence data; the affected product is identified solely from the CVE description as FastStone Image Viewer v8.3.

RemediationAI

Upgrade to the latest version of FastStone Image Viewer available at https://www.faststone.org/FSIVDownload.htm; no specific patched version number is confirmed in the available intelligence data, so the exact fix version has not been independently verified. Consult the CERT/CC advisory at https://kb.cert.org/vuls/id/936962 for vendor-confirmed patch details. If an update is not immediately possible, restrict or disable the opening of JPEG 2000 (JP2) files within the application, or configure endpoint security tools to block execution of FSViewer.exe when launched from file associations with .jp2 or .j2k extensions - note this trades JP2 functionality for reduced attack surface. User awareness training to avoid opening JP2 files from untrusted sources reduces delivery risk with no application-level side effects. No patch availability confirmation was present in the provided data beyond the vendor download page reference.