Is CVE-2026-30040 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-30040 being exploited in the wild.

How severe is CVE-2026-30040?

Informational severity, with a CVSS score of 8.8, published 26 June 2026.

Which products and versions are affected?

Faststone Image Viewer 8.3 and earlier.

Is there a fix for CVE-2026-30040?

A patch was published on 2026-06-24: Version 8.5 released (assumed fix based on release date) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-30040 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-30040?

Check whether you run Faststone Image Viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-30040: FastStone Image Viewer heap overflow in JP2 parser

CVE-2026-30040 · Severity: info · CVSS 8.8 · Published 2026-06-26

FastStone Image Viewer is a popular application used for browsing and managing digital photos. A security flaw allows attackers to take control of a user's computer if the application processes a specially crafted image file. This can happen automatically if the malicious file is simply saved in a folder the user is browsing, potentially leading to data theft or malware installation.

Technologies: Faststone Image Viewer. Vendors: Faststone.

Quick answers

Is CVE-2026-30040 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-30040 being exploited in the wild.
How severe is CVE-2026-30040?: Informational severity, with a CVSS score of 8.8, published 26 June 2026.
Which products and versions are affected?: Faststone Image Viewer 8.3 and earlier.
Is there a fix for CVE-2026-30040?: A patch was published on 2026-06-24: Version 8.5 released (assumed fix based on release date) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-30040 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-30040?: Check whether you run Faststone Image Viewer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in the FSViewer.exe process of FastStone Image Viewer (v8.3 and earlier) during the parsing of JPEG 2000 (JP2) files. The vulnerability is triggered by a malformed QCD (quantization default, 0xFF5C) marker. An attacker can exploit this by providing a crafted JP2 file; notably, the vulnerability can be triggered automatically during directory enumeration for thumbnail generation if the file is within two directory levels of the current view. Successful exploitation allows an attacker to overwrite the instruction pointer (EIP) and execute arbitrary code in the context of the current process. While the vendor has released version 8.5, the advisory notes that coordination was unsuccessful, though users are encouraged to update to the latest version.

Affected products

FastStone Image Viewer 8.3 and earlier

Timeline

2026-05-12: other: Vendor notified
2026-06-22: disclosed: Initial disclosure by CERT/CC
2026-06-24: patched: Version 8.5 released (assumed fix based on release date)
2026-06-26: advisory: NVD publication

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.