Submeter #907618: FastStone Soft FastStone Image Viewer 8.3 Out-of-bounds read / information disclosure

FastStone Image Viewer 8.3 decodes PCX images with a run-length decode path. The read source range of this path comes from the PCX header dimensions. When the PCX header has x_min greater than x_max, the decoder computes a read length and source range that go out of bounds. The copy reads from heap memory next to the intended source buffer into the decoded image buffer. The adjacent heap contains module-range pointers and other heap or string data. The out-of-bounds read pulls that content into the decoded image bytes. The viewer later renders these bytes. An attacker who can view or save the rendered result reads back heap or module memory. This defeats ASLR and exposes process memory.

CVSS 3.1 VECTOR
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Base score: 7.1 (High). Local attack through a malicious image. Low complexity. No privileges. User interaction required. High confidentiality impact (module and heap pointer leak that defeats ASLR). No integrity impact from the read itself. High availability impact (the read faults and crashes the process when it runs off into unmapped memory).

CWE
CWE-125 Out-of-bounds Read (primary). CWE-200 Information Exposure (the pointer leak).

AFFECTED VERSIONS
FastStone Image Viewer 8.3 (x.x.x.x), 32-bit build, Windows. The PCX decoder dimension handling has no validation or bounds guard in this build. Earlier versions that share the same PCX path are probably affected but not verified.

DISCLOSURE TIMELINE:
2026-04-17: Vendor contacted by EMail (no response)
2026-06-03: Follow-Up sent (no response)

ADVISORY
The password for the advisory is: -m\2mKSr|S*4
PLEASE DO NOT INCLUDE IN THE PUBLIC REPORT

• Utilizador: jonzab (UID 97521)
• Submissão: 28/07/2026 12h21 (há 2 meses)
• Moderação: 28/09/2026 11h40 (2 months later)
• Estado: Aceite
• Entrada VulDB: 411014 [FastStone Image Viewer até 8.3 PCX Decoder Divulgação de Informação]
• Pontos: 20