CVE-2025-7240
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DWG files with IrfanView's CADImage plugin. The memory corruption flaw occurs during DWG file parsing due to improper input validation. Users of IrfanView with the vulnerable CADImage plugin are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malicious actor executes code with user privileges, potentially installing malware, stealing credentials, or accessing sensitive files.
If Mitigated
Limited impact with proper application sandboxing, user privilege restrictions, and network segmentation preventing lateral movement.
🎯 Exploit Status
Requires user interaction (opening malicious file). ZDI has published advisory but no public exploit code confirmed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView website for latest CADImage plugin update
Vendor Advisory: https://www.irfanview.com/
Restart Required: Yes
Instructions:
1. Visit https://www.irfanview.com/
2. Download latest IrfanView version
3. Install update
4. Restart system
🔧 Temporary Workarounds
Disable DWG file association
windowsRemove IrfanView as default handler for DWG files
Control Panel > Default Programs > Set Associations > Find .dwg > Change program
Uninstall CADImage plugin
windowsRemove vulnerable plugin component
Control Panel > Programs > Uninstall IrfanView plugins
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use network segmentation to isolate systems running IrfanView
🔍 How to Verify
Check if Vulnerable:
Check IrfanView Help > About for version and plugin informationCheck Version:
irfanview.exe /?Verify Fix Applied:
Verify IrfanView and CADImage plugin are updated to latest versions📡 Detection & Monitoring
Log Indicators:
- IrfanView process crashes when opening DWG files
- Unusual child processes spawned from IrfanView
Network Indicators:
- Outbound connections from IrfanView process to suspicious IPs
SIEM Query:
process_name="irfanview.exe" AND (event_id=1000 OR child_process_creation)