| 제목 | FastStone Soft FastStone Image Viewer 8.3 Out-of-bounds read / information disclosure |
|---|
| 설명 | FastStone Image Viewer 8.3 decodes TGA images with an inlined rep movs copy. The source pointer and the length of this copy come from a counter that can underflow. When the counter underflows, the copy reads from a heap region next to the intended source buffer. The read goes out of bounds, past the source allocation. The copy writes those bytes into the decoded image buffer. The adjacent heap region contains heap and module-range pointers. The out-of-bounds read pulls a real FSViewer.exe module pointer into the decoded image bytes. The viewer later renders these bytes. An attacker who can view or save the rendered result reads back a FSViewer base address. This defeats ASLR for the main executable.
CVSS 3.1 VECTOR
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Base score: 7.1 (High). Local attack through a malicious image. Low complexity. No privileges. User interaction required. High confidentiality impact (module and heap pointer leak that defeats ASLR). No integrity impact from the read itself. High availability impact (the read faults and crashes the process when it runs off into unmapped memory).
CWE
CWE-125 Out-of-bounds Read (primary). CWE-200 Information Exposure (the pointer leak). CWE-787 does not apply here. This is a read.
AFFECTED VERSIONS
FastStone Image Viewer 8.3 (x.x.x.x), 32-bit build, Windows. The TGA counter handling has no underflow or bounds guard in this build. Earlier versions that share the same decode path are probably affected but not verified.
DISCLOSURE TIMELINE:
2026-04-17: Vendor contacted by EMail (no response)
2026-06-03: Follow-Up sent (no response)
ADVISORY
The password for the advisory link is: P^M1r67VK;s~
PLEASE DO NOT INCLUDE IN THE PUBLIC SUBMISSION
|
|---|
| 사용자 | jonzab (UID 97521) |
|---|
| 제출 | 2026. 07. 28. PM 12:11 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 28. AM 11:40 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 411013 [FastStone Image Viewer 까지 8.3 TGA Image FSViewer.exe 정보 공개] |
|---|
| 포인트들 | 20 |
|---|