CVE-2024-5874

Summary

CVE-2024-5874 is a remote code execution vulnerability affecting IrfanView, caused by an out-of-bounds write issue during the parsing of PNT files. The flaw arises from insufficient validation of user-supplied data, enabling an attacker to write data past the end of an allocated buffer. Exploitation requires user interaction, either through visiting a malicious webpage or opening a specially crafted file. Successful exploitation grants the attacker the ability to execute arbitrary code in the context of the IrfanView application. This vulnerability was identified as ZDI-CAN-23969 by the Zero Day Initiative.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.