CVE-2024-11508: IrfanView DXF Parsing RCE Vulnerability

CVE-2024-11508 Overview

CVE-2024-11508 is a type confusion vulnerability in IrfanView, a widely used Windows image viewer. The flaw resides in the parser that handles Drawing Exchange Format (DXF) files. Attackers can trigger arbitrary code execution when a user opens a crafted DXF file or visits a page that delivers one. The vulnerability was reported through the Trend Micro Zero Day Initiative under identifier ZDI-CAN-22184 and mapped to [CWE-843].

Critical Impact
Successful exploitation allows an attacker to execute code in the context of the current IrfanView process, leading to full compromise of the user account running the application.

Affected Products

IrfanView 4.62 (x86)
IrfanView installations that include the DXF file format plugin
Windows systems where IrfanView is used to preview untrusted image or CAD files

Discovery Timeline

2024-11-22 - CVE-2024-11508 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11508

Vulnerability Analysis

The vulnerability affects IrfanView's DXF file parser. DXF is an ASCII or binary CAD interchange format originally defined by Autodesk. IrfanView loads DXF content through a format plugin that converts vector primitives into raster output for display.

During parsing, the plugin interprets user-supplied structure fields without verifying that the underlying object matches the type the code assumes. This mismatch produces a type confusion condition classified as [CWE-843]. When the code operates on the misinterpreted object, controlled memory is used as though it were a trusted structure, giving the attacker influence over execution flow.

Because IrfanView runs in the user's security context, arbitrary code from a crafted DXF file executes with the privileges of the current user. The attack vector is local and requires user interaction, but delivery through email attachments or drive-by downloads makes exploitation practical.

Root Cause

The root cause is missing validation of user-supplied data during DXF parsing. The parser trusts type indicators inside the file and casts objects accordingly, without confirming that the actual data layout matches the expected type. See the Zero Day Initiative Advisory ZDI-24-1603 for additional technical context.

Attack Vector

An attacker crafts a malicious DXF file and delivers it through email, a web download, or a compromised file share. The victim opens the file in IrfanView or a page instructs the browser to hand the file to the application. The parser processes the malformed structures, triggers the type confusion, and hands control to attacker-supplied logic.

Detection Methods for CVE-2024-11508

Indicators of Compromise

DXF files arriving from untrusted email senders, web downloads, or removable media, particularly with unexpected sizes or non-standard section headers.
i_view32.exe or i_view64.exe spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Unexpected outbound network connections initiated by the IrfanView process shortly after a DXF file is opened.
New persistence artifacts (Run keys, scheduled tasks, startup folder entries) created in the timeframe of an IrfanView session.

Detection Strategies

Alert on process lineage where IrfanView spawns interpreters, scripting engines, or LOLBins that are inconsistent with normal image viewing.
Monitor file-open telemetry for DXF extensions handled by IrfanView on user endpoints that do not have a legitimate CAD workflow.
Correlate IrfanView memory access violations or crashes with subsequent process creation events, which can indicate exploitation attempts.

Monitoring Recommendations

Enable EDR process-tree, file-write, and network-connection recording on all endpoints that have IrfanView installed.
Ingest email gateway and web proxy logs to track delivery of DXF and other rare CAD file types to end users.
Track installed IrfanView versions across the fleet through software inventory to identify systems running 4.62 or earlier.

How to Mitigate CVE-2024-11508

Immediate Actions Required

Update IrfanView to the latest version released after ZDI-24-1603, and update all format plugins from the official distribution.
Restrict the DXF file association so that untrusted DXF files do not open automatically in IrfanView.
Block inbound DXF attachments at the email gateway when they are not required by business workflows.
Instruct users not to open DXF files received from unknown sources until patched builds are deployed.

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1603 and the IrfanView download page for the fixed release. Deploy the updated installer and matching plugin bundle to all systems where IrfanView 4.62 or earlier is present.

Workarounds

Remove or rename the DXF plugin DLL in the IrfanView Plugins directory to prevent parsing of DXF content until the patch is applied.
Enforce Attack Surface Reduction rules that block Office and image applications from launching child processes.
Run IrfanView under a least-privilege user account and enable Windows Defender Exploit Protection for the i_view32.exe and i_view64.exe binaries.

bash

# Remove the DXF format plugin from a standard IrfanView install (run as administrator)
ren "C:\Program Files (x86)\IrfanView\Plugins\DXF.dll" DXF.dll.disabled