CVE-2025-7282
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DXF files with IrfanView's CADImage plugin. Attackers can achieve full system compromise in the context of the current user. All users of IrfanView with the vulnerable CADImage plugin are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the logged-in user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation, data exfiltration, or system disruption through crafted DXF files sent via email or downloaded from malicious websites.
If Mitigated
Limited impact due to user awareness training, application sandboxing, and network segmentation preventing successful exploitation.
🎯 Exploit Status
User interaction required (opening malicious file). Memory corruption vulnerability with reliable exploitation likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView website for latest version
Vendor Advisory: https://www.irfanview.com/
Restart Required: Yes
Instructions:
1. Visit https://www.irfanview.com/
2. Download latest version of IrfanView
3. Install update
4. Restart system
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable CADImage plugin from IrfanView installation
Navigate to IrfanView plugins directory and remove CADImage.dll or similar plugin files
Block DXF File Association
windowsPrevent IrfanView from opening DXF files by default
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .dxf to open with different application
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized IrfanView execution
- Use email/web filtering to block DXF attachments and downloads from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check IrfanView Help > About for version number and compare with latest version on official websiteCheck Version:
irfanview.exe /?Verify Fix Applied:
Verify IrfanView version matches or exceeds patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- IrfanView process crashes when opening DXF files
- Unusual process spawning from IrfanView
Network Indicators:
- Downloads of DXF files from suspicious sources
- Outbound connections from IrfanView process
SIEM Query:
Process Creation where Image contains 'irfanview' AND Parent Process contains 'explorer'