CVE-2024-11519
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious RLE files in IrfanView. Attackers can gain full control of the affected system through memory corruption. All IrfanView users who open untrusted RLE files are affected.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malware installation or system compromise when users open malicious RLE files from phishing emails or compromised websites.
If Mitigated
Limited to application crash or denial of service if exploit fails or security controls block execution.
🎯 Exploit Status
Exploitation requires user interaction but is technically straightforward once a malicious file is opened. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IrfanView 4.67 and later
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download latest IrfanView from official website. 2. Run installer. 3. Follow installation prompts. 4. Verify version is 4.67 or higher.
🔧 Temporary Workarounds
Disable RLE file association
windowsRemove IrfanView as default handler for .rle files to prevent automatic opening
Control Panel > Default Programs > Set Associations > Find .rle > Change to another program or none
Block RLE files at perimeter
allConfigure email/web filters to block .rle file attachments
🧯 If You Can't Patch
- Implement application whitelisting to prevent IrfanView execution
- Use Windows Defender Application Control or AppLocker to restrict IrfanView
🔍 How to Verify
Check if Vulnerable:
Open IrfanView > Help > About > Check version number is below 4.67Check Version:
irfanview.exe /?Verify Fix Applied:
Open IrfanView > Help > About > Confirm version is 4.67 or higher📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs
- Windows Application Error events with IrfanView process
Network Indicators:
- Downloads of .rle files to user workstations
- Unusual outbound connections after IrfanView execution
SIEM Query:
EventID=1000 AND ProcessName="i_view32.exe" OR ProcessName="i_view64.exe"