CVE-2025-7286
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DXF files with IrfanView's CADImage plugin. The memory corruption flaw in DXF file parsing can lead to complete system compromise. Users of IrfanView with the CADImage plugin installed are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malicious actors distributing weaponized DXF files via email or websites to execute malware on victim systems.
If Mitigated
Limited impact if users don't open untrusted DXF files and plugin is disabled or removed.
🎯 Exploit Status
User interaction required (opening malicious file), but exploitation is straightforward once file is opened
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView updates for CADImage plugin fix
Vendor Advisory: https://www.irfanview.com/
Restart Required: No
Instructions:
1. Open IrfanView
2. Go to Help > Check for Updates
3. Install all available updates
4. Verify CADImage plugin is updated
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable plugin to prevent exploitation
Navigate to IrfanView plugins folder and rename or remove CADImage plugin files
Block DXF File Extensions
windowsPrevent DXF files from being opened with IrfanView
Use Group Policy or registry to modify file associations
🧯 If You Can't Patch
- Disable CADImage plugin completely
- Implement application whitelisting to block IrfanView execution
- Educate users not to open DXF files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version and CADImage plugin version against patched versionsCheck Version:
Open IrfanView > Help > AboutVerify Fix Applied:
Verify IrfanView and CADImage plugin are updated to latest versions📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs with memory access violations
- Unexpected IrfanView processes spawning child processes
Network Indicators:
- Outbound connections from IrfanView process to suspicious IPs
SIEM Query:
Process Creation where Parent Process Name contains 'i_view' AND Command Line contains '.dxf'