FastStone Image Viewer RCE flaws exploit JP2, PSD files
Two vulnerabilities in FastStone Image Viewer 8.3 enable remote code execution via malicious JPEG 2000 and PSD files, with JP2 flaw triggering automatically during thumbnail generation.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT/CC has disclosed two critical vulnerabilities in FastStone Image Viewer version 8.3 and earlier that allow remote code execution through specially crafted image files. CVE-2026-30040 is a heap-based buffer overflow in the JPEG 2000 parser triggered by a malformed quantization default marker. Notably, this vulnerability can be exploited automatically during thumbnail generation when the application enumerates directories, requiring no user interaction beyond having the malicious file within two directory levels of the viewed folder. CVE-2026-30041 is an integer overflow in the PSD parser caused by improper validation of height values, leading to a heap-based buffer overflow.
Both vulnerabilities allow attackers to overwrite the instruction pointer and execute arbitrary code in the context of the current process. The automatic triggering mechanism of the JP2 vulnerability makes it particularly dangerous, as users could be compromised simply by opening a folder containing a malicious file in their Downloads directory. The vendor could not be reached for coordination and no patch is available. CERT/CC recommends running the software with restricted privileges and preventing users from accessing JP2 or PSD files from untrusted sources.
Mentioned in this report
Detection guidance
FastStone Image Viewer Spawning Command Interpreter or Script Host
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects FastStoneImageViewer.exe spawning a shell, script interpreter or LOLBin, consistent with successful exploitation of the JP2/PSD parsing vulnerabilities leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FastStone Image Viewer Spawning Suspicious Child Process
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \FSViewer.exe
- \FastStoneImageViewer.exe
- \FSViewerC.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection_parent and selection_child
falsepositives:
- Administrative scripts that legitimately invoke command-line helpers from within
an image viewer plugin (rare)
- Third-party shell extensions or right-click integrations that spawn helper processes
level: high
tags:
- attack.t1203
- attack.execution
id: e278e7b0-b720-5239-9260-bacc897cba40
status: experimental
author: Vorant
Outbound Network Connection Initiated by FastStone Image Viewer Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects network connections originating from FastStoneImageViewer.exe, which normally has no need to initiate outbound network activity; indicates possible post-exploitation callback after parsing a malicious JP2/PSD file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Network Connection From FastStone Image Viewer Process
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \FSViewer.exe
- \FastStoneImageViewer.exe
- \FSViewerC.exe
filter_localhost:
DestinationIp|startswith:
- '127.'
- ::1
condition: selection and not filter_localhost
falsepositives:
- Built-in update checker contacting the vendor update server on application start
- Proxy or telemetry components bundled with the installer
level: medium
tags:
- attack.t1203
- attack.command-and-control
id: a95cc35e-9059-5ac1-99ce-f78f6aee7ada
status: experimental
author: Vorant
File Write by FastStone Image Viewer to Executable or Script Path
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects FastStoneImageViewer.exe writing a new executable, DLL, or script file to disk, which is anomalous for an image viewer and may indicate a dropped payload following successful exploitation of a JP2/PSD parsing vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FastStone Image Viewer Writing Executable or Script File
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \FSViewer.exe
- \FastStoneImageViewer.exe
- \FSViewerC.exe
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .vbs
- .bat
- .hta
condition: selection
falsepositives:
- Application self-update or plugin installation writing legitimate DLLs
- Antivirus or EDR quarantine copy operations misattributing the writer process
level: high
tags:
- attack.t1203
- attack.persistence
id: c6e7dc49-3018-51f2-bc95-a92f7910be46
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/936962
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs