CVE-2024-11539
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DXF files in IrfanView. Attackers can achieve full system compromise through memory corruption in the DXF parsing component. All users running vulnerable versions of IrfanView are affected.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker executing arbitrary code as the current user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malicious actors deliver weaponized DXF files via email or web downloads, leading to system compromise when users open them.
If Mitigated
Limited to denial of service or application crash if memory corruption doesn't lead to reliable code execution.
🎯 Exploit Status
Exploitation requires user interaction but weaponization is likely given the RCE nature. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IrfanView 4.67
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download IrfanView 4.67 or later from official website. 2. Run installer. 3. Follow installation prompts. 4. Verify version in Help > About.
🔧 Temporary Workarounds
Disable DXF file association
windowsRemove IrfanView as default handler for DXF files to prevent automatic opening
Control Panel > Default Programs > Set Associations > Find .DXF > Change to different program
Block DXF files at perimeter
allPrevent DXF files from entering the network via email or web gateways
🧯 If You Can't Patch
- Implement application whitelisting to prevent IrfanView execution
- Use Group Policy to block DXF file execution via IrfanView
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version in Help > About menu. If version is below 4.67, system is vulnerable.Check Version:
irfanview.exe /?Verify Fix Applied:
Verify IrfanView version is 4.67 or higher in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- IrfanView process spawning child processes unexpectedly
- Multiple DXF file open attempts from same source
Network Indicators:
- Unusual outbound connections from IrfanView process
- DXF file downloads from suspicious sources
SIEM Query:
process_name:"i_view32.exe" OR process_name:"i_view64.exe" AND (parent_process:explorer.exe OR cmdline:*dxf*)