CVE-2024-11545
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DXF files in IrfanView. The flaw is a use-after-free issue in DXF file parsing that enables code execution in the context of the current process. Users of vulnerable IrfanView installations are affected.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious DXF files from untrusted sources.
If Mitigated
Limited impact if users operate with minimal privileges and avoid opening untrusted files.
🎯 Exploit Status
Exploitation requires user interaction but weaponization is likely given the nature of the vulnerability and IrfanView's widespread use.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IrfanView 4.67
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download IrfanView 4.67 or later from official website. 2. Run installer. 3. Follow installation prompts. 4. Verify version in Help > About.
🔧 Temporary Workarounds
Disable DXF file association
windowsRemove IrfanView as default handler for DXF files to prevent automatic opening
Control Panel > Default Programs > Set Default Programs > Select IrfanView > Choose defaults > Uncheck .dxf
Block DXF files at perimeter
allConfigure email/web gateways to block DXF attachments and downloads
🧯 If You Can't Patch
- Implement application whitelisting to prevent execution of unauthorized code
- Run IrfanView with restricted user privileges (non-admin account)
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version in Help > About menu. If version is below 4.67, system is vulnerable.Check Version:
irfanview.exe /?Verify Fix Applied:
Verify IrfanView version is 4.67 or higher in Help > About menu.📡 Detection & Monitoring
Log Indicators:
- IrfanView process crashes when opening DXF files
- Unusual child processes spawned from IrfanView
Network Indicators:
- Outbound connections from IrfanView process to suspicious IPs
SIEM Query:
process_name:"i_view32.exe" OR process_name:"i_view64.exe" AND (event_id:1000 OR parent_process_name:"i_view*")