CVE-2024-11512: IrfanView WBZ Plugin RCE Vulnerability

CVE-2024-11512 Overview

CVE-2024-11512 is an out-of-bounds write vulnerability [CWE-787] in the IrfanView WBZ plugin. The flaw resides in the parser that handles WB1 image files. Remote attackers can execute arbitrary code in the context of the current user by delivering a crafted WB1 file. Exploitation requires user interaction, such as opening a malicious file or visiting a malicious page that triggers the associated file handler. The vulnerability was reported through the Zero Day Initiative and tracked as ZDI-CAN-22741 before receiving its CVE identifier. Refer to the Zero Day Initiative Advisory ZDI-24-1555 for the vendor coordination record.

Critical Impact
Successful exploitation yields arbitrary code execution with the privileges of the user running IrfanView, enabling full compromise of the user session.

Affected Products

IrfanView (x86 builds shipping the WBZ plugin)
Installations processing WB1 files through the WBZ plugin
Systems where IrfanView is registered as a handler for WB1 image files

Discovery Timeline

2024-11-22 - CVE-2024-11512 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11512

Vulnerability Analysis

The vulnerability exists in the WBZ plugin component that IrfanView uses to parse WB1 image files. The parser reads attacker-controlled fields from the file and uses them to drive memory write operations without validating that the destination remains within the bounds of the allocated buffer. As a result, a specially crafted WB1 file causes the plugin to write past the end of a heap buffer. Attackers can shape the file structure so that the out-of-bounds write corrupts adjacent memory in a controlled way. This corruption can be leveraged to hijack control flow and execute arbitrary code within the IrfanView process. Exploitation requires the target to open the malicious WB1 file or trigger it through a browser-invoked file handler, aligning with the UI:R requirement in the CVSS vector.

Root Cause

The root cause is missing validation of user-supplied size or length fields inside the WB1 file format. The WBZ plugin trusts these values when computing buffer offsets and copy lengths, producing a classic out-of-bounds write [CWE-787] on the heap. No sanity checks constrain the write against the actual allocation.

Attack Vector

The attack vector is local file processing with user interaction. An attacker delivers a malicious WB1 file through email, a web download, a shared drive, or a drive-by page that invokes IrfanView through registered file associations. When the victim opens the file, the WBZ plugin parses it and triggers the out-of-bounds write, giving the attacker code execution as the current user.

No verified public proof-of-concept code is available. See the Zero Day Initiative Advisory ZDI-24-1555 for technical details.

Detection Methods for CVE-2024-11512

Indicators of Compromise

WB1 or WBZ files arriving from untrusted sources, especially through email attachments or web downloads
Unexpected child processes spawned by i_view32.exe or i_view64.exe, such as command shells or script interpreters
IrfanView processes crashing with access violations while parsing image files, indicating exploit attempts or fuzzing

Detection Strategies

Endpoint behavioral monitoring for IrfanView processes performing memory corruption behaviors, code injection, or shellcode execution
File-format inspection at the mail and web gateway to flag WB1 and WBZ attachments
Correlate image viewer process crashes with subsequent process creation events to detect post-exploitation activity

Monitoring Recommendations

Log and alert on IrfanView spawning cmd.exe, powershell.exe, wscript.exe, or rundll32.exe
Track user-initiated opens of rare image formats such as WB1 and WBZ across the environment
Monitor Windows Error Reporting and crash telemetry for repeated IrfanView faults tied to the WBZ plugin binary

How to Mitigate CVE-2024-11512

Immediate Actions Required

Update IrfanView to the latest version that addresses the WBZ plugin parsing flaw, following the guidance in ZDI-24-1555
Remove or disable the WBZ plugin (Wbz.dll) from the IrfanView Plugins directory if a patched version cannot be deployed immediately
Block inbound WB1 and WBZ file types at email and web proxies until remediation is complete

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1555 and the IrfanView vendor site for the fixed plugin release. Confirm that the deployed IrfanView build and the WBZ plugin version reflect the patched files after installation.

Workarounds

Remove the WBZ plugin DLL from the IrfanView installation directory to eliminate the vulnerable parser
Unassociate WB1 and WBZ extensions from IrfanView in Windows file associations to prevent automatic invocation
Restrict IrfanView execution to a low-privilege user context and prohibit its use for opening files from untrusted sources

bash

# Configuration example: remove the vulnerable plugin on Windows endpoints
rem Remove the WBZ plugin from a default IrfanView install
del "C:\Program Files (x86)\IrfanView\Plugins\Wbz.dll"

rem Remove file associations for the affected formats
assoc .wb1=
assoc .wbz=