CVE-2024-11529
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DWG files in IrfanView. The flaw exists in DWG file parsing where improper bounds checking enables out-of-bounds reads that can lead to remote code execution. Users of vulnerable IrfanView versions who open untrusted DWG files are affected.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious DWG files from untrusted sources like email attachments or downloads.
If Mitigated
Limited impact if users only open trusted files, with potential crashes or denial of service but no code execution.
🎯 Exploit Status
Exploitation requires user interaction to open malicious file. ZDI-CAN-24604 indicates active research.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IrfanView 4.67
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download IrfanView 4.67 or later from official website. 2. Run installer. 3. Follow installation prompts. 4. Verify version in Help > About.
🔧 Temporary Workarounds
Disable DWG file association
windowsRemove IrfanView as default handler for DWG files to prevent automatic opening
Control Panel > Default Programs > Set Default Programs > Select IrfanView > Choose defaults > Uncheck .dwg
Block DWG files at perimeter
allFilter DWG attachments in email and web gateways
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use Group Policy to prevent execution of IrfanView from user directories
🔍 How to Verify
Check if Vulnerable:
Open IrfanView, go to Help > About, check if version is below 4.67Check Version:
irfanview.exe /?Verify Fix Applied:
Confirm IrfanView version is 4.67 or higher in Help > About📡 Detection & Monitoring
Log Indicators:
- IrfanView crashes with DWG files
- Process creation from IrfanView with unusual parameters
Network Indicators:
- Downloads of DWG files followed by IrfanView execution
SIEM Query:
Process:irfanview.exe AND FileExtension:.dwg