CVE-2026-116463

MediumCVSS 6.3/10Last modified Nov 2, 2026

Description

A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-119 CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
FastStone	Image Viewer	8.0; 8.1; 8.2; 8.3; 8.4; 8.5

References

Timeline

Published: Oct 26, 2026
Last modified: Nov 2, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1164675.3A security flaw has been discovered in ggml-org llama.cpp up to 0.7.0. Affected by this vulnerability is an unknown functionality of the fil CVE-2026-1164686.6A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component. This component is respon CVE-2026-1164697.1MISP Guard, a proxy-based security filter for MISP feed distribution, contains a case-sensitivity flaw in multiple policy enforcement checks CVE-2026-116478.3Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer pr CVE-2026-1164714.3A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the c CVE-2026-1164722.7A security issue was discovered in ingress-nginx where a user with permission to create an Ingress may be able to cause denial of service of CVE-2026-1164746.5The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoint CVE-2026-1164765.4A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatu CVE-2026-1164774.3A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcPro CVE-2026-1164785.3A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of t CVE-2026-1164794.3A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler CVE-2026-116488.8Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corru