CVE-2024-6818
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious PSP files in IrfanView. The flaw exists in PSP file parsing where improper input validation leads to an out-of-bounds write. Users of vulnerable IrfanView versions are affected.
💻 Affected Systems
- IrfanView
📦 What is this software?
Irfanview by Irfanview
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation leading to user account compromise, data exfiltration, and lateral movement within the network.
If Mitigated
Limited impact with code execution contained within IrfanView process boundaries, potentially causing application crash but no system-wide compromise.
🎯 Exploit Status
Exploitation requires user interaction but is technically straightforward once malicious PSP file is crafted. ZDI has confirmed the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: IrfanView 4.67 and later
Vendor Advisory: https://www.irfanview.com/main_history.htm
Restart Required: No
Instructions:
1. Download latest IrfanView from official website
2. Run installer
3. Follow installation prompts
4. Verify version is 4.67 or higher
🔧 Temporary Workarounds
Disable PSP file association
windowsRemove IrfanView as default handler for PSP files to prevent automatic opening
Control Panel > Default Programs > Set Associations > Find .psp > Change to another program or 'Look for an app in the Store'
Block PSP files at perimeter
allPrevent PSP files from entering the network via email or web downloads
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use endpoint protection with exploit prevention capabilities
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version via Help > About. If version is below 4.67, system is vulnerable.Check Version:
irfanview.exe /?Verify Fix Applied:
Verify IrfanView version is 4.67 or higher in Help > About dialog.📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs with memory access violations
- Windows Application Event Logs with Faulting Module: IrfanView
Network Indicators:
- Unusual outbound connections from IrfanView process
- PSP file downloads from untrusted sources
SIEM Query:
process_name:"i_view32.exe" OR process_name:"i_view64.exe" AND (event_id:1000 OR event_id:1001) AND faulting_module:"i_view*.exe"