CVE-2025-7270
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DWG files with IrfanView's CADImage plugin. The flaw exists in improper memory handling during DWG file parsing, enabling attackers to run code with the same privileges as the IrfanView process. Users of IrfanView with the vulnerable CADImage plugin are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation leading to user account compromise, data exfiltration, or malware installation on the affected system.
If Mitigated
Limited impact due to sandboxing, application whitelisting, or restricted user privileges preventing full system compromise.
🎯 Exploit Status
Requires user interaction (opening malicious file); memory corruption exploitation requires specific conditions
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView website for latest CADImage plugin update
Vendor Advisory: https://www.irfanview.com/
Restart Required: Yes
Instructions:
1. Visit https://www.irfanview.com/
2. Download latest IrfanView version
3. Install update
4. Restart system
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable CADImage plugin from IrfanView
Navigate to IrfanView plugins folder and remove CADImage plugin files
Block DWG File Association
windowsPrevent IrfanView from opening DWG files by default
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .dwg association
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use endpoint protection with memory corruption exploit prevention
🔍 How to Verify
Check if Vulnerable:
Check IrfanView Help > About for version and verify CADImage plugin is installedCheck Version:
irfanview.exe /?Verify Fix Applied:
Confirm IrfanView and CADImage plugin are updated to latest versions from official site📡 Detection & Monitoring
Log Indicators:
- IrfanView process crashes when opening DWG files
- Unusual child processes spawned from IrfanView
Network Indicators:
- Outbound connections from IrfanView process to unknown IPs
SIEM Query:
Process Creation where Image contains 'irfanview' and CommandLine contains '.dwg'