CVE-2024-11537

Summary

CVE-2024-11537 is a remote code execution vulnerability affecting IrfanView, specifically in its handling of DXF files. The flaw arises due to insufficient validation of user-supplied data during file parsing, leading to an out-of-bounds read. An attacker can exploit this vulnerability by crafting a malicious DXF file that, when opened or displayed in a webpage, causes the IrfanView software to read past the allocated buffer and execute arbitrary code in the context of the current process. This vulnerability, identified as ZDI-CAN-24620, requires user interaction to be exploited.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.