CVE-2024-11520

Summary

CVE-2024-11520 is an out-of-bounds write remote code execution vulnerability affecting IrfanView. This issue arises due to insufficient validation of user-supplied data during ARW file parsing, enabling attackers to write data past the allocated object's end. Successful exploitation requires user interaction, typically through visiting a malicious webpage or opening a crafted file. The vulnerability (ZDI-CAN-24488) allows attackers to execute arbitrary code in the context of the affected IrfanView installation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.