CVE-2025-7316
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DWG files with IrfanView's CADImage plugin. The memory corruption flaw occurs during DWG file parsing due to improper input validation. Users of IrfanView with the vulnerable CADImage plugin are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining the same privileges as the user running IrfanView, potentially leading to data theft, ransomware deployment, or lateral movement.
Likely Case
Attacker executes code in user context, potentially stealing credentials, installing malware, or accessing sensitive files accessible to the user.
If Mitigated
Limited impact with proper application sandboxing, user privilege restrictions, and network segmentation preventing lateral movement.
🎯 Exploit Status
Requires user interaction (opening malicious file). Memory corruption exploitation requires specific conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown from provided references
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-563/
Restart Required: Yes
Instructions:
1. Check IrfanView official website for updates
2. Update IrfanView to latest version
3. Update CADImage plugin if separate
4. Restart system after update
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable CADImage plugin from IrfanView
Navigate to IrfanView plugins directory and remove CADImage plugin files
Block DWG Files
windowsPrevent IrfanView from opening DWG files via file association changes
Use Windows Settings > Apps > Default apps to change DWG file associations
🧯 If You Can't Patch
- Restrict user privileges to limit impact of code execution
- Implement application whitelisting to prevent unauthorized executables
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version and plugin version against vendor advisoryCheck Version:
Open IrfanView > Help > About or check plugin managerVerify Fix Applied:
Verify IrfanView and CADImage plugin are updated to patched versions📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs with DWG file access
- Unexpected process execution from IrfanView
Network Indicators:
- Downloads of DWG files from untrusted sources
- Outbound connections from IrfanView process
SIEM Query:
Process creation where parent process contains 'irfanview' AND (command line contains '.dwg' OR image path contains suspicious locations)