提交 #907608: FastStone Soft FastStone Image Viewer 8.3 Out-of-bounds read / information disclosure

FastStone Image Viewer 8.3 decodes TGA images with an inlined rep movs copy. The source pointer and the length of this copy come from a counter that can underflow. When the counter underflows, the copy reads from a heap region next to the intended source buffer. The read goes out of bounds, past the source allocation. The copy writes those bytes into the decoded image buffer. The adjacent heap region contains heap and module-range pointers. The out-of-bounds read pulls a real FSViewer.exe module pointer into the decoded image bytes. The viewer later renders these bytes. An attacker who can view or save the rendered result reads back a FSViewer base address. This defeats ASLR for the main executable.

CVSS 3.1 VECTOR
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Base score: 7.1 (High). Local attack through a malicious image. Low complexity. No privileges. User interaction required. High confidentiality impact (module and heap pointer leak that defeats ASLR). No integrity impact from the read itself. High availability impact (the read faults and crashes the process when it runs off into unmapped memory).

CWE
CWE-125 Out-of-bounds Read (primary). CWE-200 Information Exposure (the pointer leak). CWE-787 does not apply here. This is a read.

AFFECTED VERSIONS
FastStone Image Viewer 8.3 (x.x.x.x), 32-bit build, Windows. The TGA counter handling has no underflow or bounds guard in this build. Earlier versions that share the same decode path are probably affected but not verified.

DISCLOSURE TIMELINE:
2026-04-17: Vendor contacted by EMail (no response)
2026-06-03: Follow-Up sent (no response)

ADVISORY
The password for the advisory link is: P^M1r67VK;s~
PLEASE DO NOT INCLUDE IN THE PUBLIC SUBMISSION

• 用户: jonzab (UID 97521)
• 提交: 2026-07-28 12時11分 (2 月前)
• 管理: 2026-09-28 11時40分 (2 months later)
• 状态: 已接受
• VulDB条目: 411013 [FastStone Image Viewer 直到 8.3 TGA Image FSViewer.exe 信息公开]
• 积分: 20