CVE-2025-7288
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DXF files with IrfanView's CADImage plugin. Attackers can gain control of the affected system through memory corruption in the DXF parsing component. Users of IrfanView with the CADImage plugin installed are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the user's system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to malware installation, credential theft, or system disruption for the affected user account.
If Mitigated
Limited impact through application sandboxing or restricted user privileges, potentially causing application crashes but no code execution.
🎯 Exploit Status
Requires user interaction (opening malicious file) but exploit development is facilitated by the memory corruption nature of the vulnerability
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown from provided references - check vendor advisory
Vendor Advisory: https://www.irfanview.com/
Restart Required: No
Instructions:
1. Visit the official IrfanView website
2. Download the latest version
3. Install the update
4. Verify CADImage plugin is updated
🔧 Temporary Workarounds
Disable DXF file association
windowsRemove IrfanView as the default handler for DXF files to prevent automatic opening
Control Panel > Default Programs > Set Associations > Find .DXF > Change to another program
Remove CADImage plugin
windowsTemporarily remove the vulnerable plugin until patched
Navigate to IrfanView plugins folder and remove CADImage plugin files
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use network segmentation to isolate systems running IrfanView from critical assets
🔍 How to Verify
Check if Vulnerable:
Check IrfanView Help > About dialog for version and plugin informationCheck Version:
irfanview.exe /?Verify Fix Applied:
Verify installed version matches or exceeds patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs with memory access violations
- Unexpected IrfanView process spawning child processes
Network Indicators:
- Outbound connections from IrfanView process to unknown IPs
SIEM Query:
Process Creation where Image contains 'i_view' AND ParentImage contains 'explorer'