CVE-2024-11517
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious JPM files in IrfanView. Attackers can gain full control of the affected system with the same privileges as the user running IrfanView. All users of vulnerable IrfanView versions are affected.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malicious actors distributing JPM files via email or websites to execute malware, steal credentials, or establish footholds in target networks.
If Mitigated
Limited to user-level access if IrfanView runs with standard user privileges, but still enables lateral movement and data exfiltration.
🎯 Exploit Status
User interaction required (opening malicious file), but exploitation is straightforward once the file is opened. ZDI has confirmed the vulnerability exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IrfanView 4.67 and later
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download IrfanView 4.67 or later from https://www.irfanview.com/
2. Run the installer
3. Follow installation prompts to update
🔧 Temporary Workarounds
Disable JPM file association
windowsRemove IrfanView as the default handler for .jpm files to prevent automatic exploitation
Control Panel > Default Programs > Set Associations > Find .jpm > Change program
Block JPM files at perimeter
allConfigure email gateways and web filters to block .jpm file attachments
🧯 If You Can't Patch
- Restrict IrfanView execution to isolated environments or virtual machines
- Implement application whitelisting to prevent unauthorized IrfanView execution
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version via Help > About. Versions below 4.67 are vulnerable.Check Version:
irfanview.exe /?Verify Fix Applied:
Verify IrfanView version is 4.67 or higher in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- IrfanView process crashes when opening JPM files
- Unusual child processes spawned from IrfanView
Network Indicators:
- Outbound connections from IrfanView process to unknown IPs
- DNS requests for suspicious domains after JPM file access
SIEM Query:
process_name:"i_view32.exe" OR process_name:"i_view64.exe" AND (event_id:1 OR parent_process_name:"explorer.exe")