| 제목 | FastStone Soft FastStone Image Viewer 8.3 Heap-based buffer overflow (out-of-bounds write) |
|---|
| 설명 | SUMMARY:
FastStone Image Viewer 8.3 computes the row byte size of an uncompressed truecolor TGA image as (3 * width) at 24 bits per pixel. It does this multiply and the copy-length math in a 16-bit/32-bit width that truncates. When the TGA width is above 0x5555 (21845) at 24 bits per pixel, or the height is 0x8000, the row size truncates. The decoder then runs a bulk rep movs copy that writes past the end of the allocated heap decode buffer. The overflow content (decoded pixel bytes) and the overflow length both come from the file. Both stay under attacker control. The overflow overwrites the FastMM heap-manager block headers and freelist pointers of the adjacent heap block. On the next allocation or free of that block, the manager walks the corrupted freelist.
This produces an arbitrary write which is therefore a code-execution-class vulnerability.
CVSS 3.1 VECTOR:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base score: 7.8 (High). Local attack vector through a malicious image file. Low complexity. No privileges. User interaction (open the image). High impact to confidentiality, integrity, and availability. If the attacker reaches full remote code execution (the arbitrary write plus the fixed-base ROP chain), the realistic impact is critical.
CWE:
CWE-787 Out-of-bounds Write (primary). CWE-122 Heap-based Buffer Overflow. CWE-190 Integer Truncation Error (the enabling arithmetic fault).
AFFECTED VERSIONS:
FastStone Image Viewer 8.3 (x.x.x.x), 32-bit build, on Windows. The decoder arithmetic has no version-specific guard in this build. Earlier versions that share the same TGA decode path are probably affected but not verified.
DISCLOSURE TIMELINE:
2026-04-17: Vendor contacted by EMail (no response)
2026-06-03: Follow-Up sent (no response)
ADVISORY:
The password for the advisory link is: \s3p<xJ(4ek$
PLEASE DO NOT INCLUDE IT IN THE PUBLIC SUBMISSION |
|---|
| 사용자 | jonzab (UID 97521) |
|---|
| 제출 | 2026. 07. 28. AM 11:51 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 28. AM 11:40 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 411011 [FastStone Image Viewer 까지 8.3 TGA Image 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|