What is the CVSS score of EUVD-2026-39773?

EUVD-2026-39773 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.6%.

Which versions of FastStone Image Viewer are affected by EUVD-2026-39773?

FastStone Image Viewer 8.3 contains a parsing vulnerability in Photoshop file handling that can lead to arbitrary code execution when users open crafted files.

How to fix or mitigate EUVD-2026-39773?

Within 24 hours: Identify and inventory all FastStone Image Viewer 8.3 installations across the organization. Within 7 days: Restrict PSD file handling by implementing application control policies to limit FastStone execution, and deploy email/web gateway rules to block or quarantine .PSD files from untrusted sources. Within 30 days: Monitor vendor announcements for patched versions (no vendor-released patch identified at time of analysis), evaluate alternative image viewers with enhanced security controls, and prepare user communication for any policy changes.

FastStone Image Viewer EUVD-2026-39773

| CVE-2026-30041 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-06-26 cve@mitre.org

GHSA-qqfj-jwq4-rqmg

RCE Denial Of Service

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.8 HIGH

File must be opened locally by a victim, so AV:L and UI:R; claimed arbitrary code execution justifies C:H/I:H/A:H rather than the input vector's availability-only impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 17:35 vuln.today

CVSS changed

Jun 26, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

Jun 26, 2026 - 15:16 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via supplying a crafted PSD file.

AnalysisAI

Arbitrary code execution and denial of service in FastStone Image Viewer 8.3 occur when the application parses a maliciously crafted Photoshop (PSD) file, triggering an integer overflow in its PSD parsing component. Affected users are those who open attacker-supplied PSD files in this Windows freeware image viewer; successful exploitation can crash the application or, per the reporter and tags, lead to code execution in the user's context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

FastStone Image Viewer is a Windows desktop image browser, viewer, and converter that natively decodes many raster formats, including Adobe's layered PSD format. The flaw lives in the routine that parses PSD file structures, where attacker-controlled size or dimension fields are used in arithmetic without bounds validation, producing an integer overflow (classic CWE-190 behavior). NVD tags the root cause as CWE-400 (Uncontrolled Resource Consumption), which fits the DoS outcome, but the claimed arbitrary-code-execution path more typically maps to an integer overflow leading to undersized allocation and a subsequent out-of-bounds write (CWE-190/CWE-787) - this CWE mismatch should be verified against the CERT/CC note. The vulnerability is reached purely through file content, not any network service.

RemediationAI

No vendor-released patch version is identified in the available data, so the primary action is to monitor the vendor's download page (https://www.faststone.org/FSIVDownload.htm) and the CERT/CC note (https://kb.cert.org/vuls/id/936962) for a fixed release beyond 8.3 and upgrade as soon as one is published. As compensating controls until a patch exists, avoid opening PSD files from untrusted or unsolicited sources in FastStone Image Viewer and route PSD handling to a different, patched application; where feasible, change the default file-association for .psd so crafted files are not auto-opened by this viewer (trade-off: workflow disruption for users who routinely view PSDs). For higher-risk environments, run the viewer under a restricted/low-integrity account or application sandbox to limit the impact of any code execution, accepting some loss of convenience and integration.