Description
A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-26
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Information Disclosure
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is an out‑of‑bounds read in the Box‑Average Downsampler component of FastStone Image Viewer. By supplying a specially crafted image up to version 8.5, the application can read memory outside the intended buffer. The resulting information disclosure could reveal sensitive data stored in the viewer’s process space, and the issue can be triggered remotely.

Affected Systems

FastStone Image Viewer, versions up to 8.5 (included in the 8.5 release series).

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score is not available, so the exploitation probability remains unknown. The vulnerability is not listed in the CISA KEV catalog, implying no publicly known active exploitation. An attacker can initiate the read by delivering a malicious image file over the network or through a remote access path. Successful exploitation could compromise confidentiality by exposing in‑process memory contents.

Generated by OpenCVE AI on October 26, 2026 at 19:23 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued update that removes the out‑of‑bounds read in the Box‑Average Downsampler of FastStone Image Viewer.
  • If an update is not yet available, restrict the image viewer from opening files received from untrusted or external sources.
  • Run the application under a limited user account or sandboxed environment to reduce the impact of any memory disclosure.

Generated by OpenCVE AI on October 26, 2026 at 19:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Title FastStone Image Viewer Box-Average Downsampler FUN_0062d96c out-of-bounds
First Time appeared Faststone
Faststone image Viewer
Weaknesses CWE-119
CWE-125
CPEs cpe:2.3:a:faststone:image_viewer:*:*:*:*:*:*:*:*
Vendors & Products Faststone
Faststone image Viewer
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:ND/RC:UR'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Faststone Image Viewer
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T18:00:15.404Z

Reserved: 2026-10-26T10:14:28.202Z

Link: CVE-2026-116463

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-26T18:17:45.207

Modified: 2026-10-26T18:39:42.503

Link: CVE-2026-116463

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T19:30:15Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-125

    Out-of-bounds Read