CVE-2024-11521
📋 TL;DR
This is a use-after-free vulnerability in IrfanView's DJVU file parser that allows remote code execution. Attackers can exploit it by tricking users into opening malicious DJVU files, potentially gaining full control of the affected system. All IrfanView users who process DJVU files are affected.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the logged-in user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation, data exfiltration, or system disruption when users open malicious DJVU files from untrusted sources.
If Mitigated
Limited impact if proper application sandboxing, least privilege, and file validation are in place.
🎯 Exploit Status
User interaction required (opening malicious file). Exploit development is straightforward given the use-after-free nature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IrfanView 4.67
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download IrfanView 4.67 or later from official website
2. Run installer and follow prompts
3. Verify installation by checking Help > About
🔧 Temporary Workarounds
Disable DJVU file association
windowsPrevent IrfanView from automatically opening DJVU files
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .djvu to open with different application
Block DJVU files at perimeter
allPrevent malicious DJVU files from reaching users
🧯 If You Can't Patch
- Run IrfanView with restricted user privileges (not as administrator)
- Implement application allowlisting to prevent unauthorized execution
🔍 How to Verify
Check if Vulnerable:
Open IrfanView, go to Help > About, check if version is earlier than 4.67Check Version:
irfanview.exe /?Verify Fix Applied:
Confirm IrfanView version is 4.67 or later in Help > About📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs with memory access violations
- Unexpected process creation from IrfanView
Network Indicators:
- Outbound connections from IrfanView process to unknown IPs
- DNS requests for suspicious domains after file open
SIEM Query:
Process Creation where Image contains 'i_view' AND ParentImage contains 'explorer'