Listen to this Post
How the CVE Works
The vulnerability exists in the IrfanView CADImage Plugin when parsing DWG files. Due to insufficient validation of user-supplied data, the plugin fails to properly check buffer boundaries during file processing. This allows an attacker to craft a malicious DWG file that triggers an out-of-bounds read when opened. By exploiting this flaw, an attacker can manipulate memory structures to achieve remote code execution within the context of the current process. User interaction is required—the victim must open the malicious file, leading to potential system compromise.
DailyCVE Form
Platform: IrfanView CADImage Plugin
Version: Vulnerable versions prior to patch
Vulnerability: Out-Of-Bounds Read RCE
Severity: Critical
Date: 07/25/2025
Prediction: Patch expected by 08/15/2025
What Undercode Say
Analytics:
strings malicious.dwg | grep "CAD" gdb -ex 'run' -ex 'disas' irfanview
How Exploit:
Craft malicious DWG file with oversized data sections to trigger OOB read.
Protection from this CVE:
Update plugin, disable DWG parsing, restrict file sources.
Impact:
Full system compromise via RCE.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
