CVE-2025-7290
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DXF files with IrfanView's CADImage plugin. Attackers can achieve remote code execution in the context of the current user process. Users of IrfanView with the CADImage plugin installed are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the logged-in user, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Malware installation or data exfiltration when users open malicious DXF files from untrusted sources.
If Mitigated
Limited impact if proper application whitelisting and user education prevent execution of malicious files.
🎯 Exploit Status
User interaction required (opening malicious file). Memory corruption vulnerability with potential for reliable exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView updates or CADImage plugin updates
Vendor Advisory: https://www.irfanview.com/
Restart Required: No
Instructions:
1. Open IrfanView
2. Go to Help > Check for Updates
3. Install any available updates
4. Alternatively, download latest version from official website
🔧 Temporary Workarounds
Disable DXF file association
windowsRemove IrfanView as default handler for DXF files
Control Panel > Default Programs > Set Associations > Find .DXF > Change program
Uninstall CADImage plugin
windowsRemove the vulnerable plugin component
Control Panel > Programs > Uninstall a program > Find IrfanView CADImage Plugin
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Educate users not to open DXF files from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check IrfanView Help > About for version and plugin informationCheck Version:
irfanview.exe /?Verify Fix Applied:
Verify IrfanView and plugins are updated to latest versions📡 Detection & Monitoring
Log Indicators:
- IrfanView process crashes when opening DXF files
- Unexpected child processes spawned from IrfanView
Network Indicators:
- Outbound connections from IrfanView process to suspicious IPs
SIEM Query:
Process Creation where Image contains 'i_view' and CommandLine contains '.dxf'