CVE-2026-116463
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A vulnerability was identified in FastStone Image Viewer up to 8.5 in the function FUN_0062d96c of the Box-Average Downsampler Engine component. The manipulation leads to an out-of-bounds read, and the attack can be initiated remotely.
Risk Assessment
Opening malicious image files in the vulnerable application may lead to memory data leakage or application crashes. The vendor did not respond to the disclosure, so a fix may not be available.
Recommendation
Restrict opening untrusted image files in FastStone Image Viewer and consider using alternative, maintained software. Monitor vendor communications for a potential fix.
Other vulnerabilities in FastStone Image Viewer
See all- CVE-2017-8826High
FastStone Image Viewer 6.2 has a 'User Mode Write AV' issue, possibly related to the jpeg_mem_term function in jmemnobs.c in libjpeg. This issue can be triggered by a malformed JPEG file mishandled by FSViewer.exe.
- CVE-2017-8785High
FastStone Image Viewer 6.2 has a 'Data from Faulting Address may be used as a return value' issue. This issue can be triggered by a malformed JPEG 2000 file that is mishandled by FSViewer.exe.
- CVE-2026-101205Medium
A vulnerability was determined in FastStone Image Viewer up to 8.3. This impacts an unknown function of the component PCX Decoder. This manipulation causes out-of-bounds read. The attack may be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-101204Medium
A vulnerability was found in FastStone Image Viewer up to 8.3. This affects an unknown function of the file FSViewer.exe of the component TGA Image Handler. The manipulation results in out-of-bounds read. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-101203Medium
A vulnerability has been found in FastStone Image Viewer up to 8.3. The impacted element is an unknown function of the component 1bpp RLE Decoder. The manipulation leads to out-of-bounds write. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.
- CVE-2026-101202Medium
A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipulation can lead to out-of-bounds write. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Original NVD description (English source)
A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS