CVE-2025-7304
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DWG files with IrfanView's CADImage plugin. Attackers can achieve full system compromise in the context of the current user. All users of IrfanView with the vulnerable CADImage plugin are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the logged-in user, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malware installation or data exfiltration through spear-phishing campaigns targeting users who handle CAD files.
If Mitigated
Limited impact if users operate with minimal privileges and security controls prevent malicious file execution.
🎯 Exploit Status
Exploitation requires user interaction but is technically straightforward once a malicious file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView plugin updates for CADImage plugin fix
Vendor Advisory: https://www.irfanview.com/
Restart Required: Yes
Instructions:
1. Open IrfanView
2. Go to Help > Check for Updates
3. Update all plugins including CADImage
4. Restart IrfanView
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable plugin to prevent exploitation
Navigate to IrfanView plugins folder and rename or delete CADImage plugin files
Block DWG Files
windowsPrevent IrfanView from opening DWG files via file association changes
Control Panel > Default Programs > Set Associations > Remove .dwg from IrfanView
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized executables
- Use email/web filtering to block malicious DWG attachments
🔍 How to Verify
Check if Vulnerable:
Check IrfanView plugin version in Help > About Plugins > CADImageCheck Version:
irfanview.exe /pluginsVerify Fix Applied:
Verify CADImage plugin version is updated to patched version📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs with memory access violations
- Unexpected process creation from IrfanView
Network Indicators:
- Outbound connections from IrfanView process to unknown IPs
SIEM Query:
Process Creation where Image contains 'irfanview' AND ParentImage contains 'explorer'