CVE-2025-7266
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DXF files with IrfanView's CADImage plugin. Attackers can gain control of the affected system through memory corruption. Users of IrfanView with the CADImage plugin installed are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the victim's machine, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Malware installation or data exfiltration when users open malicious DXF files from untrusted sources like email attachments or downloaded files.
If Mitigated
Limited impact if users only open trusted DXF files and have proper endpoint protection, though risk remains for targeted attacks.
🎯 Exploit Status
User interaction required (opening malicious file). Memory corruption vulnerabilities in file parsers are commonly weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView website for latest CADImage plugin update
Vendor Advisory: https://www.irfanview.com/
Restart Required: No
Instructions:
1. Visit https://www.irfanview.com/
2. Download latest IrfanView version
3. Install or update CADImage plugin
4. Verify plugin is updated
🔧 Temporary Workarounds
Disable DXF file association
windowsRemove IrfanView as default handler for DXF files
Control Panel > Default Programs > Set Default Programs > Select IrfanView > Choose defaults > Uncheck .DXF
Remove CADImage plugin
windowsTemporarily remove vulnerable plugin until patched
Navigate to IrfanView plugins folder and delete or rename CADImage plugin file
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use email/web filtering to block DXF attachments and downloads
🔍 How to Verify
Check if Vulnerable:
Check IrfanView Help > About Plugins for CADImage plugin versionCheck Version:
irfanview.exe /pluginsVerify Fix Applied:
Verify CADImage plugin version matches latest from vendor website📡 Detection & Monitoring
Log Indicators:
- IrfanView process spawning unexpected child processes
- Multiple DXF file open attempts from same source
Network Indicators:
- Outbound connections from IrfanView process to unknown IPs
- Unusual network traffic following DXF file access
SIEM Query:
process_name:"i_view32.exe" OR process_name:"i_view64.exe" AND (file_extension:".dxf" OR parent_process:explorer.exe)