FastStone CVE-2026-30040/30041: 8.5 is out, but no confirmed fix

Top/Articles/FastStone CVE-2026-30040/30041: 8.5 is out, but no confirmed fix

NewsPublished June 23, 2026Last updated July 29, 2026

Table of contents

Key takeaways

FastStone Image Viewer (8.3.0.0 and earlier), a free image viewer, has two flaws (CVE-2026-30040 / 30041) that let a crafted image take over a PC; the former triggers from automatic thumbnail generation alone. The vendor is unreachable and no patch exists, so mitigations — not processing untrusted images — are essential.

Correction — July 29, 2026

This article originally assumed the vendor was unreachable and had shipped nothing since. The vendor has in fact released two newer versions, 8.4 and 8.5. We re-checked the vendor's own site and each advisory, and correct the following.

▸The version shipping today is 8.5, released June 24, 2026, preceded by 8.4 on May 29, 2026 (version history / download page). Saying the vendor has gone silent was inaccurate: it has not answered on this issue, but development of the product continues
▸There is no evidence that 8.5 is the fix. Neither the 8.4 nor the 8.5 changelog mentions security, vulnerabilities, JP2 (JPEG 2000), PSD, or buffer overflows. 8.5 adds SVG support, improves dark theme in the PDF viewer, and fixes non-clickable links in PDFs; 8.4 added PDF and JPEG XL support
▸For context, the same changelog records for 7.0 (March 22, 2019): "Fixed a vulnerability that may cause program to crash on corrupted or ill-intentioned images." This vendor spells out security fixes in the changelog when it makes them. It has not done so this time
▸CERT/CC VU#936962 is still Revision 1, dated June 22, 2026, with vendor status "Unknown" and the line "We have not received a statement from the vendor." JVNVU#98582044 likewise still carries its June 23, 2026 date and simply points readers to the CERT/CC advisory
▸So whether 8.5 closes these holes cannot be established from public information. The article stands by "no confirmed fix," which means "nothing shows it was fixed" — not "8.5 was confirmed vulnerable"
▸NVD has since assigned CVSS 3.1 scores to both CVEs (via CISA-ADP): CVE-2026-30040 is 6.5 (medium) and CVE-2026-30041 is 7.5 (high)

Version	Released	Relation to these CVEs
8.5 (shipping now)	June 24, 2026	No mention in the changelog → unknown whether affected
8.4	May 29, 2026	No mention in the changelog → unknown whether affected
8.3	December 1, 2025	Named as affected by CERT/CC and JVN (8.3.0.0 and earlier)

FastStone Image Viewer, a free image viewer and manager in wide use, has flaws that can let a crafted image file take over a PC. They are tracked as CVE-2026-30040 and CVE-2026-30041. In Japan, JVN (JVNVU#98582044) issued an advisory on June 23, 2026, and the U.S. CERT/CC tracks it as VU#936962.

What demands extra caution is that no version has been confirmed to fix this. The vendor has released 8.4 and 8.5 since, but neither changelog mentions these flaws, and CERT/CC has received no statement from the vendor. The advisories name FastStone Image Viewer 8.3.0.0 and earlier as affected; whether 8.4 and 8.5 belong on that list cannot be determined from public information. CVE-2026-30040 is especially nasty because it triggers just from automatic thumbnail generation when a folder is opened — without the user even clicking an image. For now, protect yourself by not processing untrusted image files.

Software	FastStone Image Viewer 8.3.0.0 and earlier (8.4 / 8.5 unknown)
CVEs	CVE-2026-30040 / CVE-2026-30041 (JVNVU#98582044)
Type	Heap buffer overflow Integer overflow
Severity (CVSS 3.1)	CVE-2026-30040: 6.5 (medium) CVE-2026-30041: 7.5 (high)
What can happen	Arbitrary code execution (current user privileges)
Fix status	No confirmed fix (mitigate instead)
Published	June 2026 (JVN / CERT/CC)

Who is at risk, and what is the damage

The target is an attacker who gets a FastStone Image Viewer user to open a crafted image file, or slips one into a folder they will browse. Email attachments, download sites, shared folders, USB sticks — there are countless ways images arrive. The trick lands where you accept something as "just an image."

The scary part is how easily it triggers. CVE-2026-30040 can be exploited simply by FastStone generating thumbnails (the small previews) for a folder that contains the crafted file — without even opening the image. The other, CVE-2026-30041, triggers when a crafted PSD (Photoshop) file is processed. On success, the attacker can run arbitrary programs on that PC, at the privileges of the logged-in user.

The damage can extend to theft of personal files like photos and documents and saved credentials, takeover of the PC, and from there a foothold for ransomware or intrusion into the internal network. The usual answer — "just update to the latest version" — does not apply here. A latest version, 8.5, does exist, but nothing backs it as closing these holes, which is why the mitigations below matter.

What is happening, technically

CVE-2026-30040 is a heap buffer overflow (CWE-122). Per CERT/CC's VU#936962, it occurs while automatic thumbnail generation enumerates a directory and processes files within two levels; a write beyond the allocated size can overwrite the instruction pointer (EIP) that decides where the program runs, leading to arbitrary code execution.

CVE-2026-30041 stems from an integer overflow (CWE-190) that in turn causes a heap buffer overflow. It triggers when a crafted PSD file is processed and, by controlling the instruction pointer, can lead to code execution or a crash (denial of service). The classification NVD attached to this CVE is CWE-400 (resource exhaustion) — a different angle on the same bug the CVE text describes as an integer overflow. Either way, the root cause is the software failing to safely handle malformed data hidden inside an image.

On CVSS 3.1, the 0–10 severity scale, NVD's scores (assigned by CISA-ADP) put CVE-2026-30040 at 6.5 (medium) and CVE-2026-30041 at 7.5 (high). Neither approaches the 10.0 ceiling, but both need nothing more than a user handling a crafted file, so neither is a number to shrug at.

Confirmed vs. still unknown

✓ Confirmed facts

✓CVE-2026-30040 triggers on automatic thumbnail generation and can reach code execution (no click needed) (CERT/CC)
✓CVE-2026-30041 triggers on processing a crafted PSD and can lead to code execution or a crash
✓The advisories name 8.3.0.0 and earlier as affected (JVN)
✓The vendor has shipped 8.4 (May 29, 2026) and 8.5 (June 24, 2026), but neither changelog mentions these flaws (version history)
✓CERT/CC has had no reply from the vendor; VU#936962 still lists vendor status as "Unknown" (CERT/CC)
✓CVSS 3.1: 6.5 (medium) for CVE-2026-30040, 7.5 (high) for CVE-2026-30041 (NVD)

? Not yet confirmed

?Whether 8.4 or 8.5 fixed this — the changelogs say nothing and CERT/CC has no vendor statement, so it cannot be settled. Nor has anyone published testing that shows 8.4 or 8.5 still vulnerable
?Whether exploited in the wild — the July 27, 2026 CISA KEV catalog has no FastStone entry, and no public proof-of-concept has surfaced
?How the vendor intends to handle this — there is no public reply on the issue. New releases keep coming, though, so development has not stopped

What to do now

With no version confirmed to fix this, the baseline is to avoid letting dangerous files be processed. CERT/CC recommends not downloading or processing untrusted JP2 (JPEG 2000) or PSD image files, and running under a limited (non-administrator) account. Even if exploited, that keeps the damage within the current user's privileges.

In addition, do not open folders of unknown images in FastStone (to avoid automatic thumbnail generation), and do not open unexpected attached images. For files you truly must inspect, handle them in an isolated environment or a different viewer. If your organization uses FastStone widely, consider an alternative viewer and review how the thumbnail feature is used.

One warning about that last habit: finding a newer version on the vendor's site does not mean you have found the fix. Open the download page today and you get 8.5, with nothing anywhere claiming it closes these holes. Do not read a higher version number as "safe now." Two things are worth watching instead.

▸ How to tell whether it has actually been fixed

1Whether CERT/CC VU#936962 gets revised. If the revision number and date move past Revision 1 of June 22, 2026 and the vendor status changes from "Unknown," a vendor statement has landed. JVNVU#98582044 should update around the same time
2Whether a security line appears in the vendor's changelog. This vendor wrote "Fixed a vulnerability that may cause program to crash on corrupted or ill-intentioned images" for 7.0 back in March 2019, so expect it to say so again. Look for "vulnerability," "security," or "crash," or a mention of JP2 or PSD, in the entry for a new release

Summary

FastStone Image Viewer 8.3.0.0 and earlier have two flaws (CVE-2026-30040 at CVSS 6.5, CVE-2026-30041 at 7.5) that can lead to arbitrary code execution via a crafted image, and the former can trigger from automatic thumbnail generation alone. The vendor has released 8.4 and 8.5, but nothing in either says these flaws were fixed. The key is self-defense through mitigations: do not process untrusted images, and run under a limited account.

That "just an image" can be an entry point is an easily overlooked risk. Until a fix is confirmed, judge by CERT/CC revisions and security lines in the changelog rather than by version numbers, and pay extra attention to where the images you receive come from.

References

Makoto Horikawa

Backend Engineer / AWS / Django