CVE-2024-9112
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of FastStone Image Viewer by tricking users into opening a malicious PSD file. The flaw exists in how the software parses PSD files, enabling out-of-bounds writes that can lead to remote code execution. All users of affected FastStone Image Viewer versions are at risk.
💻 Affected Systems
- FastStone Image Viewer
📦 What is this software?
Image Viewer by Faststone
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's computer, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Attacker executes malicious code with the privileges of the current user, potentially stealing credentials, installing malware, or accessing sensitive files.
If Mitigated
Limited impact if user runs with minimal privileges, has application sandboxing, or security software blocks the malicious file.
🎯 Exploit Status
Exploitation requires user to open malicious file but is otherwise straightforward. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 7.7 or later
Vendor Advisory: https://www.faststone.org/FSViewerDetail.htm
Restart Required: Yes
Instructions:
1. Download latest version from FastStone website
2. Run installer
3. Restart computer if prompted
🔧 Temporary Workarounds
Disable PSD file association
windowsRemove PSD file type association with FastStone Image Viewer to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Select .PSD > Change program
Use alternative image viewer
windowsTemporarily use different software to view PSD files until patched
🧯 If You Can't Patch
- Restrict user permissions to limit damage if exploited
- Implement application whitelisting to prevent unauthorized executables
🔍 How to Verify
Check if Vulnerable:
Check Help > About in FastStone Image Viewer for version numberCheck Version:
Not applicable - check via GUI Help > About menuVerify Fix Applied:
Verify version is 7.7 or higher in Help > About📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening PSD files
- Unusual process creation from FastStoneImageViewer.exe
Network Indicators:
- Downloads of PSD files from untrusted sources
- Outbound connections after opening PSD files
SIEM Query:
Process Creation where Image contains 'FastStoneImageViewer.exe' and CommandLine contains '.psd'