Executive Summary

CVE-2026-30041 is an integer overflow vulnerability in the PSD (Photoshop Document) parser component of FastStone Image Viewer version 8.3 and earlier.

The vulnerability occurs due to insufficient validation of the height value in PSD files, which can lead to a heap-based buffer overflow.

An attacker can exploit this by supplying a specially crafted PSD file that triggers the overflow when processed by the software.

This can result in arbitrary code execution or cause a denial of service (application crash).

The vulnerability can be triggered without direct user interaction, for example during automatic operations like thumbnail generation.

Useful 0 Not Useful 0

Impact Analysis

Exploitation of this vulnerability can allow an attacker to execute arbitrary code on the affected system, potentially gaining control over the program's execution flow.

This could lead to unauthorized actions depending on the privileges of the user running FastStone Image Viewer.

Alternatively, the vulnerability can cause a persistent denial of service by crashing the application when processing a malicious PSD file.

Since the vulnerability can be triggered without user interaction, simply opening or previewing a crafted PSD file could compromise the system.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying the presence of FastStone Image Viewer version 8.3 or earlier on your system, as these versions contain the vulnerable PSD parser.

Since the vulnerability is triggered by processing crafted PSD files, monitoring for unexpected crashes or abnormal behavior when opening or generating thumbnails of PSD files can be an indicator.

There are no specific commands provided to detect exploitation attempts or the vulnerability itself.

• Check installed FastStone Image Viewer version: Open the application and verify the version number in the About section.
• Monitor application logs or system event logs for crashes related to FastStone Image Viewer.
• Use file integrity monitoring to detect unexpected PSD files being opened or processed.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting the download and opening of PSD files from untrusted or unknown sources to prevent processing of malicious files.

Run FastStone Image Viewer under a limited local user account to reduce the impact of potential exploitation.

Since no patch is currently available, consider upgrading to FastStone Image Viewer version 8.5 or later once it is confirmed to address this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0