CVE-2024-11573
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DXF files in IrfanView. Attackers can gain full control of affected systems through memory corruption during DXF file parsing. All users of vulnerable IrfanView versions are affected.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the logged-in user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious DXF files from untrusted sources.
If Mitigated
Limited impact with proper application sandboxing and user awareness training preventing file execution.
🎯 Exploit Status
Exploitation requires user interaction but is straightforward once malicious DXF file is opened. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IrfanView 4.67 and later
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download latest IrfanView from official website. 2. Run installer. 3. Follow installation prompts. 4. Verify version is 4.67 or higher.
🔧 Temporary Workarounds
Disable DXF file association
windowsRemove IrfanView as default handler for DXF files to prevent automatic opening.
Control Panel > Default Programs > Set Associations > Find .dxf > Change program
Application sandboxing
windowsRun IrfanView in restricted environment to limit impact of exploitation.
🧯 If You Can't Patch
- Implement application allowlisting to block IrfanView execution
- Deploy email/web filtering to block DXF attachments and downloads
🔍 How to Verify
Check if Vulnerable:
Open IrfanView > Help > About, check if version is below 4.67Check Version:
irfanview.exe /?Verify Fix Applied:
Confirm IrfanView version is 4.67 or higher in About dialog📡 Detection & Monitoring
Log Indicators:
- IrfanView process crashes when opening DXF files
- Unusual child processes spawned from IrfanView
Network Indicators:
- Outbound connections from IrfanView process to unknown IPs
SIEM Query:
process_name:"i_view32.exe" OR process_name:"i_view64.exe" AND (event_id:1000 OR parent_process contains unusual)