CVE-2026-30041 Overview
CVE-2026-30041 is an integer overflow vulnerability in the Photoshop Document (PSD) parser component of FastStone Image Viewer v8.3. Attackers can trigger the flaw by supplying a crafted PSD file to a vulnerable installation. Successful exploitation leads to arbitrary code execution or a denial of service (DoS) condition affecting the application. The issue is tracked under [CWE-400] and is exposed through file processing workflows, which typically involve user interaction with attacker-supplied content. FastStone Image Viewer is a widely deployed freeware image browsing and conversion tool on Windows endpoints.
Critical Impact
A crafted PSD file can trigger an integer overflow in FastStone Image Viewer v8.3, enabling arbitrary code execution or application crash.
Affected Products
- FastStone Image Viewer v8.3
- Windows systems running FastStone Image Viewer with PSD file parsing enabled
- Workflows that automatically preview or convert PSD files using FastStone components
Discovery Timeline
- 2026-06-26 - CVE-2026-30041 published to the National Vulnerability Database
- 2026-06-26 - Last updated in NVD database
Technical Details for CVE-2026-30041
Vulnerability Analysis
The vulnerability resides in the PSD parser component of FastStone Image Viewer v8.3. When the parser processes fields inside a crafted PSD file, an arithmetic operation on untrusted size or offset values overflows the fixed-width integer used to represent the result. The overflowed value is then used in subsequent memory operations, breaking downstream size validation and producing undefined behavior. Depending on how the corrupted value is consumed, the outcome ranges from an application crash to attacker-controlled memory writes suitable for arbitrary code execution. The classification under uncontrolled resource consumption [CWE-400] reflects the DoS impact path, while the arbitrary code execution path stems from the same integer arithmetic error. According to the Exploit Prediction Scoring System, the vulnerability currently carries an EPSS probability of 0.571% at the 43.029 percentile.
Root Cause
The root cause is missing or insufficient validation of size-related values parsed from PSD headers or embedded structures. An arithmetic operation on those values wraps around the integer range, producing a small or negative result that bypasses subsequent bounds checks.
Attack Vector
An attacker delivers a crafted PSD file to a target user through email, web download, shared storage, or a chat platform. Opening or previewing the file inside FastStone Image Viewer v8.3 triggers the vulnerable parsing path and executes the attacker's payload or crashes the application.
No verified public proof-of-concept code is available. See the CERT Vulnerability Advisory #936962 for coordination details.
Detection Methods for CVE-2026-30041
Indicators of Compromise
- Unexpected termination or repeated crashes of FSViewer.exe when opening PSD files
- Creation of Windows Error Reporting artifacts referencing FastStone Image Viewer following PSD file access
- Child processes spawned by FSViewer.exe that are inconsistent with normal image viewing behavior
- PSD files arriving from untrusted sources with anomalous header sizes or malformed layer structures
Detection Strategies
- Alert on process crashes or exception events in FSViewer.exe correlated with recent PSD file access
- Monitor for FSViewer.exe spawning shells, script interpreters, or LOLBins such as cmd.exe, powershell.exe, or rundll32.exe
- Inspect email and web gateways for PSD attachments delivered to users with FastStone Image Viewer installed
Monitoring Recommendations
- Enable process creation and image load logging on endpoints where FastStone Image Viewer is deployed
- Track installations and versions of FastStone Image Viewer through software inventory to identify v8.3 hosts
- Forward endpoint telemetry to a centralized analytics platform to correlate PSD file handling with anomalous process activity
How to Mitigate CVE-2026-30041
Immediate Actions Required
- Identify all endpoints running FastStone Image Viewer v8.3 and restrict PSD file handling until a fixed version is available
- Block or quarantine PSD files from untrusted sources at email and web gateways
- Remove the default association between the .psd file extension and FastStone Image Viewer on high-risk endpoints
- Advise users not to open PSD files received from unknown senders or downloaded from untrusted websites
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Monitor the FastStone FSIV Download Page and the CERT Vulnerability Advisory #936962 for updates and release notes addressing CVE-2026-30041.
Workarounds
- Uninstall FastStone Image Viewer v8.3 on systems that do not require PSD viewing functionality
- Use an alternative image viewer for PSD files until a fixed release is confirmed
- Enforce application control policies that prevent FSViewer.exe from spawning script interpreters or command shells
- Route PSD attachments through a sandboxed conversion service before user access
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
