CVE-2025-7320
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on systems running vulnerable versions of IrfanView with the CADImage plugin. Attackers can exploit this by tricking users into opening malicious DXF files, leading to memory corruption and potential system compromise. Users of IrfanView with the CADImage plugin are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining the same privileges as the current user, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Local privilege escalation or malware installation on the victim's system, with potential for data exfiltration or persistence mechanisms.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions, potentially resulting in application crash only.
🎯 Exploit Status
Requires user interaction (opening malicious file). ZDI-CAN-26418 tracking number indicates coordinated disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check IrfanView updates for CADImage plugin fix
Vendor Advisory: https://www.irfanview.com/
Restart Required: Yes
Instructions:
1. Open IrfanView
2. Go to Help > Check for Updates
3. Install available updates
4. Restart IrfanView
🔧 Temporary Workarounds
Disable CADImage Plugin
windowsRemove or disable the vulnerable CADImage plugin from IrfanView
Navigate to IrfanView plugins folder and remove CADImage.dll or similar plugin files
Block DXF File Association
windowsPrevent IrfanView from opening DXF files by default
Control Panel > Default Programs > Associate a file type or protocol with a program > Change .dxf association to another program
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized IrfanView execution
- Use endpoint protection with memory corruption detection capabilities
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version and verify CADImage plugin is present in plugins folderCheck Version:
Open IrfanView > Help > About IrfanViewVerify Fix Applied:
Verify IrfanView is updated to latest version and CADImage plugin version is patched📡 Detection & Monitoring
Log Indicators:
- IrfanView crash logs with memory access violations
- Unexpected IrfanView process spawning child processes
Network Indicators:
- Unusual outbound connections from IrfanView process
SIEM Query:
Process Creation where Image contains 'i_view' and CommandLine contains '.dxf'