CVE-2025-7308
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of IrfanView with the CADImage plugin. Attackers can exploit it by tricking users into opening malicious DWG files or visiting malicious web pages. Users of IrfanView with the CADImage plugin are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation leading to malware installation, data exfiltration, or persistence mechanisms being established on the compromised system.
If Mitigated
Limited impact due to application sandboxing or restricted user privileges, potentially resulting in application crash rather than code execution.
🎯 Exploit Status
Requires user interaction (opening malicious DWG file). Memory corruption vulnerability in DWG parsing.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView website for latest version
Vendor Advisory: https://www.irfanview.com/
Restart Required: Yes
Instructions:
1. Visit https://www.irfanview.com/
2. Download latest version of IrfanView
3. Install update
4. Restart system
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable CADImage plugin from IrfanView
Navigate to IrfanView plugins directory and remove CADImage.dll
Block DWG Files
windowsPrevent IrfanView from opening DWG files via file association changes
Control Panel > Default Programs > Associate file type with program > Change .dwg association
🧯 If You Can't Patch
- Restrict user privileges to limit potential damage from exploitation
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check IrfanView Help > About for version number and verify CADImage plugin is installedCheck Version:
Open IrfanView > Help > AboutVerify Fix Applied:
Verify IrfanView version is latest from official website and test opening DWG files📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs with memory access violations
- Unexpected process creation from IrfanView
Network Indicators:
- Outbound connections from IrfanView process to suspicious IPs
SIEM Query:
Process Creation where Image contains 'i_view' AND ParentImage contains 'explorer'