| タイトル | FastStone Soft FastStone Image Viewer 8.3 Heap-based buffer overflow (out-of-bounds write) |
|---|
| 説明 | FastStone Image Viewer 8.3 decodes 1-bit-per-pixel run-length-encoded TGA images (image type 9 or higher, pixel depth 1) into a fixed 1024-byte buffer. It computes the decode length as the sum of (run_count * 3) across the RLE packets. It does not check that the accumulated output stays within the 1024-byte buffer. The per-packet run counts come byte-by-byte from the file, and the code does not range-check them. An attacker can drive the total decoded output past the end of the buffer. The overflow is byte-granular and tunable per run count. This path allows a precise overwrite of exactly the adjacent FastMM heap block header. This produces a controlled heap-metadata corruption and a controlled write.
ROOT CAUSE
The 1bpp RLE decoder accumulates output as sum(count * 3) but never checks the running total against the 1024-byte destination buffer. The code reads the run counts straight from the file. The run counts have no upper bound. There is no per-packet or cumulative bounds check before the decode writes.
CVSS 3.1 VECTOR
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base score: 7.8 (High). Local attack through a malicious image. Low complexity. No privileges. User interaction required. High CIA impact. The byte-granular control makes reliable code execution achievable, so the realistic severity is critical.
CWE
CWE-787 Out-of-bounds Write (primary). CWE-122 Heap-based Buffer Overflow. CWE-190 Integer Truncation/Error (unchecked accumulated length).
AFFECTED VERSIONS
FastStone Image Viewer 8.3 (x.x.x.x), 32-bit build, Windows. The 1bpp RLE decode path has no bounds guard in this build. Earlier versions that share the same path are probably affected but not verified.
DISCLOSURE TIMELINE:
2026-04-17: Vendor contacted by EMail (no response)
2026-06-03: Follow-Up sent (no response)
ADVISORY
Password for advisory link: e=P\-5Ka{'@`
PLEASE DO NOT INCLUDE IN THE PUBLIC REPORT |
|---|
| ユーザー | jonzab (UID 97521) |
|---|
| 送信 | 2026年07月28日 12:07 (2 月 ago) |
|---|
| モデレーション | 2026年09月28日 11:40 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 411012 [FastStone Image Viewer 迄 8.3 1bpp RLE Decoder メモリ破損] |
|---|
| ポイント | 20 |
|---|