CVE-2025-7234
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of IrfanView with the CADImage plugin. Attackers can exploit this by tricking users into opening malicious CGM files or visiting malicious web pages. Users of IrfanView with the CADImage plugin are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system, data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation leading to data exfiltration, system disruption, or use as a foothold for further attacks within the network.
If Mitigated
Limited impact due to application sandboxing, limited user privileges, or network segmentation preventing lateral movement.
🎯 Exploit Status
User interaction required (opening malicious file). ZDI advisory suggests exploit is feasible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView website for latest version
Vendor Advisory: https://www.irfanview.com
Restart Required: No
Instructions:
1. Visit https://www.irfanview.com
2. Download latest version of IrfanView
3. Install update
4. Verify CADImage plugin is updated
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable CADImage plugin from IrfanView
Navigate to IrfanView plugins directory and remove CADImage plugin files
Block CGM Files
allPrevent opening of CGM files at system or network level
🧯 If You Can't Patch
- Restrict user privileges to limit impact of code execution
- Implement application whitelisting to prevent unauthorized executables
🔍 How to Verify
Check if Vulnerable:
Check IrfanView Help > About for version and verify CADImage plugin is presentCheck Version:
Open IrfanView > Help > AboutVerify Fix Applied:
Verify IrfanView version is latest and CADImage plugin version is updated📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs
- Unexpected process execution from IrfanView
Network Indicators:
- Downloads of CGM files from untrusted sources
SIEM Query:
Process creation where parent process is IrfanView and command line contains suspicious parameters