CVE-2025-7244
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DWG files with IrfanView's CADImage plugin. The memory corruption flaw occurs during DWG file parsing due to insufficient input validation. Users of IrfanView with the vulnerable CADImage plugin are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration through spear-phishing campaigns targeting users who regularly handle CAD files.
If Mitigated
No impact if users avoid opening untrusted DWG files or if the plugin is disabled/removed.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file). The vulnerability is memory corruption-based, which typically requires some exploit development.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown from provided references - check IrfanView updates
Vendor Advisory: https://www.irfanview.com/
Restart Required: Yes
Instructions:
1. Open IrfanView
2. Go to Help > Check for Updates
3. Download and install latest version
4. Restart IrfanView
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable plugin to prevent exploitation
Navigate to IrfanView plugins folder and remove CADImage.dll or rename it
Block DWG File Extensions
windowsPrevent IrfanView from opening DWG files via file association changes
Control Panel > Default Programs > Set Associations > Change .dwg to open with different application
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use email/web filtering to block DWG attachments from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version and plugin version in Help > About dialogCheck Version:
irfanview.exe /?Verify Fix Applied:
Verify IrfanView is updated to latest version and CADImage plugin is updated or removed📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs with memory access violations
- Unexpected IrfanView processes spawning child processes
Network Indicators:
- Outbound connections from IrfanView process to suspicious IPs
SIEM Query:
Process Creation where Image contains 'irfanview' AND ParentImage contains 'explorer'