FastStone Image Viewer RCE flaws exploit JP2, PSD files
Two vulnerabilities in FastStone Image Viewer 8.3 enable remote code execution via malicious JPEG 2000 and PSD files, with JP2 flaw triggering automatically during thumbnail generation.
CERT/CC has disclosed two critical vulnerabilities in FastStone Image Viewer version 8.3 and earlier that allow remote code execution through specially crafted image files. CVE-2026-30040 is a heap-based buffer overflow in the JPEG 2000 parser triggered by a malformed quantization default marker. Notably, this vulnerability can be exploited automatically during thumbnail generation when the application enumerates directories, requiring no user interaction beyond having the malicious file within two directory levels of the viewed folder. CVE-2026-30041 is an integer overflow in the PSD parser caused by improper validation of height values, leading to a heap-based buffer overflow.
Both vulnerabilities allow attackers to overwrite the instruction pointer and execute arbitrary code in the context of the current process. The automatic triggering mechanism of the JP2 vulnerability makes it particularly dangerous, as users could be compromised simply by opening a folder containing a malicious file in their Downloads directory. The vendor could not be reached for coordination and no patch is available. CERT/CC recommends running the software with restricted privileges and preventing users from accessing JP2 or PSD files from untrusted sources.
Mentioned in this report
Detection guidance
FastStone Image Viewer Spawning Command Interpreter or Script Host
Detects FastStoneImageViewer.exe spawning a shell, script interpreter or LOLBin, consistent with successful exploitation of the JP2/PSD parsing vulnerabilities leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FastStone Image Viewer Spawning Suspicious Child Process
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \FSViewer.exe
- \FastStoneImageViewer.exe
- \FSViewerC.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection_parent and selection_child
falsepositives:
- Administrative scripts that legitimately invoke command-line helpers from within
an image viewer plugin (rare)
- Third-party shell extensions or right-click integrations that spawn helper processes
level: high
tags:
- attack.t1203
- attack.execution
id: e278e7b0-b720-5239-9260-bacc897cba40
status: experimental
author: Vorant
Outbound Network Connection Initiated by FastStone Image Viewer Process
Detects network connections originating from FastStoneImageViewer.exe, which normally has no need to initiate outbound network activity; indicates possible post-exploitation callback after parsing a malicious JP2/PSD file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Network Connection From FastStone Image Viewer Process
logsource:
category: network_connection
product: windows
detection:
selection:
Image|endswith:
- \FSViewer.exe
- \FastStoneImageViewer.exe
- \FSViewerC.exe
filter_localhost:
DestinationIp|startswith:
- '127.'
- ::1
condition: selection and not filter_localhost
falsepositives:
- Built-in update checker contacting the vendor update server on application start
- Proxy or telemetry components bundled with the installer
level: medium
tags:
- attack.t1203
- attack.command_and_control
id: a95cc35e-9059-5ac1-99ce-f78f6aee7ada
status: experimental
author: Vorant
File Write by FastStone Image Viewer to Executable or Script Path
Detects FastStoneImageViewer.exe writing a new executable, DLL, or script file to disk, which is anomalous for an image viewer and may indicate a dropped payload following successful exploitation of a JP2/PSD parsing vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FastStone Image Viewer Writing Executable or Script File
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith:
- \FSViewer.exe
- \FastStoneImageViewer.exe
- \FSViewerC.exe
TargetFilename|endswith:
- .exe
- .dll
- .ps1
- .vbs
- .bat
- .hta
condition: selection
falsepositives:
- Application self-update or plugin installation writing legitimate DLLs
- Antivirus or EDR quarantine copy operations misattributing the writer process
level: high
tags:
- attack.t1203
- attack.persistence
id: c6e7dc49-3018-51f2-bc95-a92f7910be46
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/936962
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free