CVE-2021-29362
📋 TL;DR
A buffer overflow vulnerability in IrfanView's RLE file parser allows attackers to execute arbitrary code by tricking users into opening a specially crafted RLE image file. This affects users of IrfanView 4.57 who open untrusted RLE files, potentially leading to complete system compromise.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/administrator privileges leading to full system compromise, data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation or arbitrary code execution in the context of the current user when opening malicious RLE files from email attachments or downloads.
If Mitigated
Limited impact if user runs with restricted privileges, has application sandboxing, or doesn't process untrusted RLE files.
🎯 Exploit Status
Public research available with proof-of-concept. Exploitation requires user to open malicious RLE file but doesn't require authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IrfanView 4.58 or later
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download latest IrfanView from official website. 2. Run installer. 3. Follow installation prompts. 4. Verify version is 4.58 or higher.
🔧 Temporary Workarounds
Disable RLE file association
windowsRemove IrfanView as default handler for .rle files to prevent automatic exploitation
Control Panel > Default Programs > Set Associations > Find .rle > Change to Notepad or remove association
Application sandboxing
windowsRun IrfanView in restricted environment to limit exploit impact
🧯 If You Can't Patch
- Block RLE files at email gateways and web proxies
- Implement least privilege - run IrfanView with standard user accounts only
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version via Help > About. If version is 4.57, system is vulnerable.Check Version:
irfanview.exe /?Verify Fix Applied:
Verify IrfanView version is 4.58 or higher via Help > About menu.📡 Detection & Monitoring
Log Indicators:
- Process creation from IrfanView with suspicious command-line arguments
- Crash logs from IrfanView with RLE file references
Network Indicators:
- Downloads of .rle files from untrusted sources
- Email attachments with .rle extensions
SIEM Query:
process_name="i_view32.exe" OR process_name="i_view64.exe" AND (file_extension=".rle" OR cmdline_contains="rle")