CVE-2019-17258
📋 TL;DR
CVE-2019-17258 is a memory corruption vulnerability in IrfanView's JPEG-LS decoder that allows an attacker to control a write address through data from a faulting address. This affects users of IrfanView 4.53 who open malicious JPEG-LS images. Attackers could potentially execute arbitrary code on the victim's system.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/administrator privileges leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash (denial of service) or limited code execution in the context of the current user.
If Mitigated
Application crash with no code execution if DEP/ASLR protections are effective.
🎯 Exploit Status
Exploitation requires user to open a malicious JPEG-LS file. Public research demonstrates the vulnerability but weaponized exploits may exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.54 and later
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download latest IrfanView from official website. 2. Run installer. 3. Follow installation prompts. 4. Verify version is 4.54 or higher.
🔧 Temporary Workarounds
Disable JPEG-LS plugin
windowsRemove or disable the JPEG-LS plugin to prevent processing of vulnerable file format
Move or delete plugins\JPEG_LS.dll from IrfanView installation directory
File type association removal
windowsRemove IrfanView as default handler for JPEG-LS files
Control Panel > Default Programs > Set Associations > Remove .jls/.jpeg-ls from IrfanView
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use Group Policy to prevent opening of .jls/.jpeg-ls files with IrfanView
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version via Help > About. If version is 4.53, system is vulnerable.Check Version:
irfanview.exe /?Verify Fix Applied:
Verify version is 4.54 or higher in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- Application crashes in IrfanView with access violation in JPEG_LS.dll
- Windows Event Logs showing IrfanView process termination
Network Indicators:
- Downloads of .jls/.jpeg-ls files from untrusted sources
- Unusual outbound connections after IrfanView execution
SIEM Query:
source="Windows Security" AND event_id=4688 AND process_name="i_view32.exe" OR process_name="i_view64.exe"