CVE-2024-11507: IrfanView DXF File Parsing RCE Vulnerability

CVE-2024-11507 Overview

CVE-2024-11507 is a type confusion vulnerability [CWE-843] in IrfanView, a widely deployed image viewer for Windows. The flaw exists in the parser that processes Drawing Exchange Format (DXF) files. Attackers can exploit the vulnerability to execute arbitrary code in the context of the current user process. Exploitation requires the target to open a crafted DXF file or visit a malicious page delivering one. The issue was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-22177 and published in advisory ZDI-24-1604.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user running IrfanView, enabling malware installation, data theft, or lateral movement.

Affected Products

IrfanView 4.62 (x86)
Earlier IrfanView releases containing the vulnerable DXF parser
Systems using IrfanView plugins that register DXF file handling

Discovery Timeline

2024-11-22 - CVE-2024-11507 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11507

Vulnerability Analysis

The vulnerability is a type confusion condition [CWE-843] triggered while IrfanView parses DXF files. DXF is an ASCII or binary CAD interchange format containing tagged records that describe geometric entities. The parser reads attacker-controlled fields and treats them as objects of a type different from their actual layout in memory. When the code dereferences the misinterpreted object, it operates on memory that does not match the expected structure. Attackers who control the confused fields can steer execution flow and achieve arbitrary code execution within the IrfanView process.

Root Cause

The root cause is missing validation of user-supplied data inside the DXF parsing routines. The parser trusts type or tag fields from the input file and casts data to an incompatible internal structure without checking size, layout, or object identity. This mismatch enables attackers to control function pointers, virtual tables, or object metadata reached during subsequent operations.

Attack Vector

Exploitation requires user interaction. A victim must open a malicious .dxf file or visit a web page that triggers IrfanView to process one. The attack vector is local, but delivery is trivial through email attachments, drive-by downloads, or shared file locations. Because IrfanView runs with the user's privileges, successful exploitation yields code execution at that integrity level. See the Zero Day Initiative Advisory ZDI-24-1604 for the underlying research reference.

Detection Methods for CVE-2024-11507

Indicators of Compromise

Unexpected child processes spawned by i_view32.exe or i_view64.exe, particularly command interpreters or scripting hosts
DXF files arriving through email, chat, or web downloads from untrusted senders
Crashes of IrfanView followed by anomalous outbound network connections from the user session

Detection Strategies

Monitor process creation events where IrfanView is the parent process and the child is cmd.exe, powershell.exe, rundll32.exe, or another living-off-the-land binary
Alert on IrfanView loading unusual DLLs from user-writable paths such as %TEMP% or %APPDATA%
Flag file-write activity by IrfanView to autostart locations or the Windows Registry Run keys

Monitoring Recommendations

Enable command-line and image-load logging via Windows Event Log or Sysmon for IrfanView binaries
Track opens of .dxf files across endpoints and correlate with subsequent process anomalies
Baseline normal IrfanView plugin activity so that new modules loaded from the Plugins directory are reviewed

How to Mitigate CVE-2024-11507

Immediate Actions Required

Update IrfanView to the latest release available from the vendor once a fixed version is published
Restrict opening of DXF files from untrusted sources across email gateways and endpoint controls
Remove IrfanView from systems that do not require image viewing or CAD file support

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1604 for coordinated disclosure details and vendor status. Administrators should confirm the installed version is later than IrfanView 4.62 and monitor the IrfanView release notes for a fix addressing the DXF parser.

Workarounds

Unregister the .dxf file association from IrfanView so the format is not auto-parsed
Remove or disable IrfanView DXF-handling plugins located in the Plugins subdirectory
Enforce application control policies that prevent IrfanView from spawning shells or writing to autostart locations
Run IrfanView under a low-integrity account or within an application sandbox to limit blast radius

bash

# Configuration example: remove the DXF file association on Windows
assoc .dxf=
ftype IrfanView.DXF=