Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-101202: FastStone Image Viewer allows remote code execution via TGA files
CVE-2026-101202 · published 20 days ago
Summary
FastStone Image Viewer versions up to 8.3 can be tricked by a specially crafted TGA picture file to write data outside its intended memory area. This can let an attacker run their own code on a user’s computer without needing physical access. Update to a newer version or stop opening TGA files from untrusted sources until a fix is available.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| faststone | image viewer | 8.0 |
Original advisory text
FastStone Image Viewer TGA Image out-of-bounds write
A flaw has been found in FastStone Image Viewer up to 8.3. The affected element is an unknown function of the component TGA Image Handler. Executing a manipulation can lead to out-of-bounds write. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-787Out-of-bounds Write
CWE-119Buffer Overflow
Timeline
Published28 Sep 2026
Updated19 Oct 2026
First seen28 Sep 2026
Track software like this
Free during beta