CVE-2024-11563

Summary

CVE-2024-11563 is an out-of-bounds read remote code execution vulnerability affecting IrfanView. Malicious DXF files can exploit this flaw by causing the software to read past the end of an allocated buffer, leading to arbitrary code execution. User interaction is necessary, as the target must open a malicious file or visit a malicious website to trigger the exploit. The root cause of this issue is insufficient validation of user-supplied data during DXF file parsing. This vulnerability, originally identified as ZDI-CAN-24860, poses a significant risk to IrfanView users.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.