FastStone Image Viewer contains an out-of-bounds write flaw in the 1bpp RLE decoder. The vulnerability can corrupt memory when a specially crafted image is processed, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The description confirms a remote attack vector, implying that a malicious image file can be delivered over a network or via local user activity.

The flaw exists in FastStone Image Viewer versions up to 8.3. Users running any of these releases are vulnerable; all later releases are presumed fixed until proven otherwise.

The CVSS score of 5.3 places this vulnerability in the moderate severity range. No EPSS score is available, and it is not listed in the CISA KEV catalog, suggesting limited publicly known exploitation. Because the attack requires a crafted image, the risk to systems that only accept trusted input is lower, but the potential for remote code execution remains if an attacker can deliver the file to an affected instance.