CVE-2025-7322
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code by tricking users into opening malicious DWG files with IrfanView's CADImage plugin. The flaw exists in how the plugin parses DWG files, enabling out-of-bounds reads that can lead to remote code execution. Users of IrfanView with the CADImage plugin installed are affected.
💻 Affected Systems
- IrfanView CADImage Plugin
📦 What is this software?
Cadimage by Cadsofttools
Cadimage by Cadsofttools
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control of the affected system in the context of the current user.
Likely Case
Malware installation, data theft, or ransomware deployment through user-initiated malicious file opening.
If Mitigated
Limited impact with proper application sandboxing and user privilege restrictions.
🎯 Exploit Status
Requires user interaction to open malicious DWG file. ZDI advisory suggests exploit development is feasible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - check IrfanView updates
Vendor Advisory: https://www.irfanview.com/
Restart Required: No
Instructions:
1. Open IrfanView
2. Go to Help → Check for Updates
3. Install available updates
4. Verify CADImage plugin is updated
🔧 Temporary Workarounds
Disable DWG file association
windowsRemove IrfanView/CADImage plugin as default handler for DWG files
Control Panel → Default Programs → Set Associations → Remove .dwg from IrfanView
Uninstall CADImage plugin
windowsRemove the vulnerable plugin entirely
Control Panel → Programs → Uninstall → Remove IrfanView CADImage Plugin
🧯 If You Can't Patch
- Implement application whitelisting to block IrfanView execution
- Use application sandboxing to contain potential exploits
🔍 How to Verify
Check if Vulnerable:
Check IrfanView version and CADImage plugin version against patched releases from vendorCheck Version:
Open IrfanView → Help → About → Check version numbersVerify Fix Applied:
Verify IrfanView and CADImage plugin are updated to latest versions📡 Detection & Monitoring
Log Indicators:
- IrfanView process crashes when opening DWG files
- Unusual child processes spawned from IrfanView
Network Indicators:
- Outbound connections from IrfanView process to unknown IPs
SIEM Query:
Process Creation where ParentImage contains 'i_view' and CommandLine contains '.dwg'