CVE-2019-17245
📋 TL;DR
CVE-2019-17245 is a memory corruption vulnerability in IrfanView's WSQ file parser that allows attackers to execute arbitrary code or cause denial of service. The vulnerability affects users who open malicious WSQ image files with IrfanView 4.53. Attackers can exploit this by tricking users into opening specially crafted WSQ files.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the IrfanView user, potentially leading to full system compromise.
Likely Case
Application crash (denial of service) or limited code execution within the IrfanView process context.
If Mitigated
Application crash with no further impact if proper sandboxing or application whitelisting is in place.
🎯 Exploit Status
Exploitation requires user interaction to open a malicious file. The vulnerability is in the WSQ parsing code at WSQ!ReadWSQ+0x4359.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.54 and later
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download IrfanView 4.54 or later from www.irfanview.com. 2. Run the installer. 3. Follow installation prompts to update.
🔧 Temporary Workarounds
Disable WSQ file association
windowsRemove IrfanView as the default handler for WSQ files to prevent automatic exploitation.
Control Panel > Default Programs > Set Associations > Find .WSQ > Change program to another application
Block WSQ files at perimeter
allConfigure email/web gateways to block WSQ file attachments.
🧯 If You Can't Patch
- Restrict user permissions to limit impact of potential code execution.
- Implement application whitelisting to prevent unauthorized executables from running.
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version via Help > About. If version is 4.53, the system is vulnerable.Check Version:
irfanview.exe /?Verify Fix Applied:
Verify IrfanView version is 4.54 or later after update.📡 Detection & Monitoring
Log Indicators:
- Application crash logs from IrfanView
- Windows Event Logs showing IrfanView process termination
Network Indicators:
- Unusual outbound connections from IrfanView process
SIEM Query:
source="windows" AND (process_name="i_view64.exe" OR process_name="i_view32.exe") AND event_id=1000