CVE-2025-7233
📋 TL;DR
This vulnerability in IrfanView's CADImage plugin allows attackers to read memory beyond allocated buffers when processing malicious DWG files, potentially disclosing sensitive information. Users who open specially crafted DWG files or visit malicious websites hosting such files are affected. The vulnerability requires user interaction but could be combined with other exploits for more severe attacks.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Information disclosure leads to memory content leakage, which could reveal sensitive data or be combined with other vulnerabilities for arbitrary code execution.
Likely Case
Information disclosure from memory reads, potentially exposing application data or system information.
If Mitigated
Limited impact with proper file validation and user awareness preventing malicious file execution.
🎯 Exploit Status
Requires user interaction to open malicious file; ZDI advisory suggests exploit possible
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView updates for CADImage plugin fixes
Vendor Advisory: https://www.irfanview.com/
Restart Required: Yes
Instructions:
1. Open IrfanView
2. Go to Help > Check for Updates
3. Install latest version
4. Restart application
🔧 Temporary Workarounds
Disable DWG file association
windowsRemove DWG file type association with IrfanView to prevent automatic opening
Control Panel > Default Programs > Associate a file type or protocol with a program > Remove .dwg association with IrfanView
Block DWG downloads
allUse web filtering to block .dwg file downloads from untrusted sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent IrfanView execution
- Use sandboxed environments for opening untrusted DWG files
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version and CADImage plugin version against vendor advisoryCheck Version:
Open IrfanView > Help > AboutVerify Fix Applied:
Verify IrfanView is updated to latest version and CADImage plugin is patched📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs when processing DWG files
- Unexpected memory access errors in application logs
Network Indicators:
- Downloads of .dwg files from untrusted sources
SIEM Query:
process_name:"i_view32.exe" AND file_extension:".dwg"