EUVD-2026-88557
GHSA-39cx-9v2h-jx3h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious TGA file
-
DeliveryDeliver via email or web download
-
ExploitVictim opens file in FSViewer.exe
-
ExecutionTrigger out-of-bounds read in TGA handler
-
ImpactLeak adjacent memory or crash viewer
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted TGA image file in FastStone Image Viewer version 8.3 or earlier (UI:P - passive user interaction is mandatory). There is no server-side or unattended trigger: the attacker must first deliver the file and rely on the user opening it in the vulnerable TGA Image Handler. Limiting factors: the flaw is a read-only out-of-bounds primitive (information disclosure or crash, not code execution per the data), it is confined to the Windows desktop client, and no fixed version exists since the vendor did not respond. No authentication is involved (PR:N), but the required user interaction and consumer-desktop context substantially narrow realistic risk. |
| Impact | This is a low-priority, client-side memory-safety issue despite the network attack vector in the CVSS 4.0 vector. The vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) yields a base of 5.3 (medium), but the 'network' vector is really file-delivery: the AV:N combined with UI:P (passive user interaction required) means a victim must be lured into opening a crafted TGA file in FastStone Image Viewer - this is not a remotely triggerable server-side flaw. Exploitation status: publicly available exploit code exists (VulDB marks E:P / Proof-of-Concept), but this must NOT be conflated with active exploitation - the CVE is NOT in CISA KEV and no EPSS score is provided, so there is no evidence of in-the-wild or automatable exploitation. The CWE-125 out-of-bounds READ caps realistic impact at limited information disclosure or an application crash; the vendor's VI:L/VA:L are generous for a pure read primitive. Note a signal conflict: the description states 'attack can be launched remotely' while the mechanism is opening a local file - these are reconciled by treating delivery as remote and trigger as local user action. Overall this is a high-CVSS-appearance-but-low-real-risk issue on a consumer desktop application, appropriate for routine patch scheduling rather than urgent response. |
| Exploit ScenarioDerived | An attacker crafts a malicious TGA image file and delivers it via email, web download, or a file-sharing site; when the victim opens it in FastStone Image Viewer (up to v8.3), the TGA handler in FSViewer.exe reads past a buffer boundary, disclosing adjacent process memory or crashing the application. A proof-of-concept is referenced by VulDB (E:P), but there is no evidence of active exploitation, and success depends on the user choosing to open the crafted file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Opening a maliciously crafted TGA image in FastStone Image Viewer 8.3 or earlier triggers an out-of-bounds read in the TGA Image Handler implemented in FSViewer.exe, allowing a remote attacker to disclose process memory or crash the application. The CVSS 4.0 vector rates this 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L) and carries E:P, indicating proof-of-concept exploit maturity; there is no CISA KEV entry, so confirmed active exploitation is not established. The vendor was contacted about the disclosure but did not respond, so no fixed version is available and the practical risk is a low-priority, client-side memory-safety issue that depends on the victim opening the crafted file (UI:P).
RemediationAI
No vendor-released patch is identified at time of analysis: FastStone did not respond to the disclosure, so there is no confirmed fixed version to upgrade to and users should monitor the vendor and VulDB entries (https://vuldb.com/vuln/411013 and https://vuldb.com/cve/CVE-2026-101204) for a remediation release. Until then, the most effective control is to avoid opening TGA files from untrusted sources in FastStone Image Viewer, or to sanitize/re-encode them first in a hardened or disposable environment (Windows Sandbox, a VM, or a headless converter) before viewing - the trade-off being added workflow friction and the need for a second tool for legitimate TGA workflows. Organizations can block .tga attachments and downloads at mail and web gateways, which stops the delivery vector but breaks legitimate image-sharing use cases. Running the viewer under a low-privilege, non-administrative account limits the value of any leaked process memory and reduces crash-to-privilege-escalation chaining opportunities, at the cost of potentially breaking workflows that expect elevated access. Because the primitive is a read-only out-of-bounds read, enabling standard Windows exploit mitigations (DEP, ASLR, Exploit Guard) and keeping the host patched provides incremental hardening but should not be relied on as a substitute for not opening untrusted TGA files.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-125 out-of-bounds read in the TGA (Truevision Targa) image handler of FastStone Image Viewer, a Windows desktop image viewer/browser distributed as FSViewer.exe. TGA files use a compact 18-byte header (image ID length, color map type, image type, color map and image dimensions, pixel depth, image descriptor) followed by optional color-map and pixel data. Parsers that trust the declared dimensions, pixel depth, or offsets without validating them against the actual file size can read past the end of the allocated buffer, and the tags assigned to this record (Buffer Overflow, Information Disclosure, Image Viewer) are consistent with a parsing-bounds weakness in that code path. Because the primitive is read-only, the realistic outcomes are memory disclosure or an access-violation crash rather than reliable code execution; the CPE cpe:2.3:a:faststone:image_viewer:*:*:*:*:*:*:*:* carries no version constraint, so it covers all releases through the stated 8.3 ceiling. Attack delivery is remote (email attachment, web download, shared folder), but exploitation is inherently gated on the user opening the file in the vulnerable handler, matching the assessed CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L.
Know when Image Viewer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Crafted file delivered remotely but opened by the user (UI:R); out-of-bounds read yields limited memory disclosure (C:L) and possible crash (A:L), with no integrity impact (I:N).
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Image Viewer
View allFastStone Image Viewer v.<= 7.5 is affected by a Stack-based Buffer Overflow at 0x005BDF49, affecting the CUR file parsi
FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x00000000001a9601. Rated high severity (C
FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x00000000001a95b1. Rated high severity (C
FastStone Image Viewer 7.0 has a User Mode Write AV starting at image00400000+0x0000000000002d7d. Rated high severity (C
Unsafe Parsing of a PNG tRNS chunk in FastStone Image Viewer through 7.5 results in a stack buffer overflow. Rated criti
FastStone Image Viewer 6.2 has a "User Mode Write AV" issue, possibly related to the jpeg_mem_term function in jmemnobs.
FastStone Image Viewer 6.2 has a "Data from Faulting Address may be used as a return value" issue. Rated high severity (
FastStone Image Viewer GIF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CV
FastStone Image Viewer TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CV
FastStone Image Viewer PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. Rated high severity (CV
FastStone Image Viewer <= 7.5 is affected by a user mode write access violation at 0x00402d7d, triggered when a user ope
FastStone Image Viewer <= 7.5 is affected by a user mode write access violation near NULL at 0x005bdfc9, triggered when
Exploit-DB