CVE-2024-11549

Summary

CVE-2024-11549 is a remote code execution vulnerability affecting IrfanView, a popular image viewer software. The flaw is located in the application's DXF file parsing module, which fails to validate user-supplied data properly. This weakness allows an attacker to write data past the end of an allocated buffer, resulting in a buffer overflow. Successful exploitation of this vulnerability requires user interaction, either through visiting a malicious webpage or opening a specially crafted DXF file. The attacker can then execute arbitrary code in the context of the affected IrfanView installation. This vulnerability, identified as ZDI-CAN-24746, can pose a significant risk to computer systems and networks where IrfanView is used.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.