CVE-2025-7255
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DWG files with IrfanView's CADImage plugin. The flaw exists in how the plugin parses DWG files, leading to memory corruption. Users of IrfanView with the CADImage plugin installed are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious DWG files from untrusted sources.
If Mitigated
Limited impact if users only open trusted files and have proper endpoint protection.
🎯 Exploit Status
Requires user interaction to open malicious file. No public exploit code known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView updates or plugin updates
Vendor Advisory: https://www.irfanview.com/
Restart Required: No
Instructions:
1. Open IrfanView
2. Go to Help > Check for Updates
3. Install any available updates
4. Verify CADImage plugin is updated
🔧 Temporary Workarounds
Disable DWG file association
windowsPrevent IrfanView from automatically opening DWG files
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .dwg to open with different application
Remove CADImage plugin
windowsTemporarily remove the vulnerable plugin
Delete or rename the CADImage plugin DLL file in IrfanView plugins folder
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use endpoint protection with memory corruption detection
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version and CADImage plugin version against patched versionsCheck Version:
Open IrfanView > Help > AboutVerify Fix Applied:
Verify IrfanView and CADImage plugin are updated to latest versions📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs when processing DWG files
- Unexpected IrfanView process spawning child processes
Network Indicators:
- Downloads of DWG files from untrusted sources
SIEM Query:
Process Creation where Image contains 'i_view' AND ParentImage contains 'explorer'