CVE-2024-11567

Summary

CVE-2024-11567 is a remote code execution vulnerability affecting IrfanView. Malicious DXF files can trigger an out-of-bounds read, which allows attackers to execute arbitrary code on affected systems. This issue stems from insufficient validation of user-supplied data during DXF file parsing. User interaction, such as opening a malicious file or visiting a malicious webpage, is necessary for an attacker to exploit this vulnerability. Was previously identified as ZDI-CAN-24871.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.