A flaw discovered in FastStone Image Viewer version 8.3 and earlier resides in an undisclosed function of the TGA Image Handler component, allowing an attacker to write data beyond the bounds of the allocated memory buffer. This out-of-bounds write can corrupt adjacent memory, potentially leading to arbitrary code execution or other forms of unauthorized system compromise. The flaw is classified under CWE‑119 and CWE‑787 and is reported to be exploitable remotely by supplying a crafted TGA image.

The vulnerability affects FastStone Image Viewer from the FastStone software vendor. All releases through version 8.3 are impacted; newer releases have not been documented as affected. The product’s TGA image handling functionality is the direct vector for exploitation.

The CVSS score of 5.3 indicates a moderate severity level, and the EPSS score is currently unavailable. The vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. However, the attack is feasible over the network via a malicious TGA file and could be leveraged by an attacker who can deliver such a file to a user. Without an immediate vendor patch, the risk remains moderate to high depending on the exposure of the vulnerable application in an environment, especially if the tool is used for processing untrusted images.