CVE-2024-44914
📋 TL;DR
This vulnerability in IrfanView allows attackers to cause an access violation via a specially crafted EXR image file, leading to application crashes and Denial of Service. Users who open untrusted EXR files with IrfanView v4.67.1.0 are affected.
💻 Affected Systems
- IrfanView
📦 What is this software?
Exr by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash and potential system instability if the access violation triggers broader memory corruption.
Likely Case
IrfanView crashes when processing a malicious EXR file, causing temporary DoS for the user.
If Mitigated
No impact if users avoid opening untrusted EXR files or have patched versions.
🎯 Exploit Status
Proof of concept available on GitHub demonstrates crash via crafted EXR file. No authentication required - user just needs to open the file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Unknown
Restart Required: No
Instructions:
Check IrfanView website for updated version. Uninstall v4.67.1.0 and install latest version if available.
🔧 Temporary Workarounds
Disable EXR file association
windowsRemove IrfanView as default handler for EXR files to prevent automatic opening
Control Panel > Default Programs > Set Default Programs > Select IrfanView > Choose defaults > Uncheck .exr
Use alternative image viewer for EXR files
windowsConfigure system to use different software for EXR files
Right-click EXR file > Open with > Choose another app > Select alternative viewer > Always use this app
🧯 If You Can't Patch
- Educate users to never open EXR files from untrusted sources
- Implement application whitelisting to restrict IrfanView execution
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version via Help > About. If version is 4.67.1.0, system is vulnerable.Check Version:
irfanview.exe /?Verify Fix Applied:
Install updated version from official IrfanView website and verify version is newer than 4.67.1.0📡 Detection & Monitoring
Log Indicators:
- Application crash logs from IrfanView
- Windows Event Logs showing access violation errors
Network Indicators:
- Unusual EXR file downloads to user workstations
SIEM Query:
EventID=1000 AND ProcessName="i_view64.exe" OR ProcessName="i_view32.exe" AND ExceptionCode="0xc0000005"