Sunghun Oh

An integer overflow in the PSD parser compnent of FastStone Image Viewer v8.3 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via supplying a crafted PSD file.

**Name of the Vulnerable Software and Affected Versions** FastStone Image Viewer versions prior to 8.3.0.1 **Description** Heap-based buffer overflow flaws exist in the JP2 and PSD file parsers within the FSViewer.exe process. A malformed QCD (quantization default) marker (0xFF5C) in a crafted JPEG 2000 (JP2) file can overwrite the EIP (instruction pointer), allowing for arbitrary code execution and control-flow corruption in the context of the current process. This issue can be triggered during directory enumeration, potentially without direct user interaction to open the file. **Recommendations** Avoid processing unknown or untrusted JP2 and PSD files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.