Remote Code Execution Vulnerability in FastStone Image Viewer
CVE-2024-9114

7.8HIGH

Key Information:

Vendor

Faststone

Status
Image Viewer
Vendor
CVE Published:
22 November 2024

What is CVE-2024-9114?

A vulnerability exists in FastStone Image Viewer related to the parsing of GIF files, which can be exploited by remote attackers to execute arbitrary code. This particular flaw arises from inadequate validation of user-supplied data, allowing attackers to write past the allocated buffer. Exploitation of this vulnerability necessitates user interaction, as targets must either visit a malicious web page or open a specially crafted GIF file. When successfully exploited, an attacker can execute code within the context of the current user process, compromising system integrity.

Affected Version(s)

Image Viewer 7.8

References

https://www.zerodayinitiative.com/advisories/ZDI-24-1275/
x_research-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.