# FastStone Image Viewer RCE flaws exploit JP2, PSD files

Published: 2026-06-22 · Severity: high
Canonical: https://vorant.io/reports/b4df6968-e37e-58e6-969a-6f164967651e/faststone-image-viewer-rce-flaws-exploit-jp2-psd-files

> Two vulnerabilities in FastStone Image Viewer 8.3 enable remote code execution via malicious JPEG 2000 and PSD files, with JP2 flaw triggering automatically during thumbnail generation.

CERT/CC has disclosed two critical vulnerabilities in FastStone Image Viewer version 8.3 and earlier that allow remote code execution through specially crafted image files. CVE-2026-30040 is a heap-based buffer overflow in the JPEG 2000 parser triggered by a malformed quantization default marker. Notably, this vulnerability can be exploited automatically during thumbnail generation when the application enumerates directories, requiring no user interaction beyond having the malicious file within two directory levels of the viewed folder. CVE-2026-30041 is an integer overflow in the PSD parser caused by improper validation of height values, leading to a heap-based buffer overflow.

Both vulnerabilities allow attackers to overwrite the instruction pointer and execute arbitrary code in the context of the current process. The automatic triggering mechanism of the JP2 vulnerability makes it particularly dangerous, as users could be compromised simply by opening a folder containing a malicious file in their Downloads directory. The vendor could not be reached for coordination and no patch is available. CERT/CC recommends running the software with restricted privileges and preventing users from accessing JP2 or PSD files from untrusted sources.

## Mentioned in this report

- Vulnerabilities: CVE-2026-30040, CVE-2026-30041

## Detection guidance (public sample)

### FastStone Image Viewer Spawning Command Interpreter or Script Host

ATT&CK: T1203

Detects FastStoneImageViewer.exe spawning a shell, script interpreter or LOLBin, consistent with successful exploitation of the JP2/PSD parsing vulnerabilities leading to code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FastStone Image Viewer Spawning Suspicious Child Process
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \FSViewer.exe
    - \FastStoneImageViewer.exe
    - \FSViewerC.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection_parent and selection_child
falsepositives:
- Administrative scripts that legitimately invoke command-line helpers from within
  an image viewer plugin (rare)
- Third-party shell extensions or right-click integrations that spawn helper processes
level: high
tags:
- attack.t1203
- attack.execution
id: e278e7b0-b720-5239-9260-bacc897cba40
status: experimental
author: Vorant
```

### Outbound Network Connection Initiated by FastStone Image Viewer Process

ATT&CK: T1203

Detects network connections originating from FastStoneImageViewer.exe, which normally has no need to initiate outbound network activity; indicates possible post-exploitation callback after parsing a malicious JP2/PSD file. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Network Connection From FastStone Image Viewer Process
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
    - \FSViewer.exe
    - \FastStoneImageViewer.exe
    - \FSViewerC.exe
  filter_localhost:
    DestinationIp|startswith:
    - '127.'
    - ::1
  condition: selection and not filter_localhost
falsepositives:
- Built-in update checker contacting the vendor update server on application start
- Proxy or telemetry components bundled with the installer
level: medium
tags:
- attack.t1203
- attack.command_and_control
id: a95cc35e-9059-5ac1-99ce-f78f6aee7ada
status: experimental
author: Vorant
```

### File Write by FastStone Image Viewer to Executable or Script Path

ATT&CK: T1203

Detects FastStoneImageViewer.exe writing a new executable, DLL, or script file to disk, which is anomalous for an image viewer and may indicate a dropped payload following successful exploitation of a JP2/PSD parsing vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: FastStone Image Viewer Writing Executable or Script File
logsource:
  category: file_event
  product: windows
detection:
  selection:
    Image|endswith:
    - \FSViewer.exe
    - \FastStoneImageViewer.exe
    - \FSViewerC.exe
    TargetFilename|endswith:
    - .exe
    - .dll
    - .ps1
    - .vbs
    - .bat
    - .hta
  condition: selection
falsepositives:
- Application self-update or plugin installation writing legitimate DLLs
- Antivirus or EDR quarantine copy operations misattributing the writer process
level: high
tags:
- attack.t1203
- attack.persistence
id: c6e7dc49-3018-51f2-bc95-a92f7910be46
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/936962

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b4df6968-e37e-58e6-969a-6f164967651e/faststone-image-viewer-rce-flaws-exploit-jp2-psd-files.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup