CVE-2025-7272
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DXF files with IrfanView's CADImage plugin. The memory corruption flaw in DXF file parsing can lead to complete system compromise. Users of IrfanView with the CADImage plugin installed are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious DXF files from untrusted sources.
If Mitigated
Limited impact if user runs with minimal privileges and security controls prevent execution of malicious payloads.
🎯 Exploit Status
Requires user interaction (opening malicious file) but exploit development is likely straightforward given the memory corruption nature
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown from provided references
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-521/
Restart Required: No
Instructions:
1. Check IrfanView official website for updates
2. Update to latest version of IrfanView and CADImage plugin
3. Verify plugin version after update
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable CADImage plugin from IrfanView
Navigate to IrfanView plugins directory and remove CADImage plugin files
Block DXF File Association
windowsPrevent IrfanView from opening DXF files by default
Use Windows File Association settings to change DXF file handler
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized executables
- Restrict user privileges to limit potential damage from exploitation
🔍 How to Verify
Check if Vulnerable:
Check IrfanView Help > About dialog for version information and verify CADImage plugin is installedCheck Version:
irfanview.exe /? or check Help > About in the applicationVerify Fix Applied:
Update IrfanView and CADImage plugin, then verify version is newer than vulnerable versions📡 Detection & Monitoring
Log Indicators:
- IrfanView process spawning unexpected child processes
- Crash logs from IrfanView when processing DXF files
Network Indicators:
- Outbound connections from IrfanView process to suspicious IPs
SIEM Query:
Process Creation where ParentImage contains 'irfanview.exe' and CommandLine contains '.dxf'