CVE-2024-11515 Overview
CVE-2024-11515 is an out-of-bounds write vulnerability in IrfanView, a widely deployed Windows image viewer. The flaw resides in the parser for JPM files, a JPEG 2000 multi-layer image format. Attackers can trigger the condition by convincing a user to open a crafted JPM file or visit a page that delivers one. Successful exploitation permits arbitrary code execution in the context of the current user. The Zero Day Initiative tracked the issue as ZDI-CAN-24010 and published advisory ZDI-24-1598.
Critical Impact
Attackers who deliver a malicious JPM file can achieve code execution on affected IrfanView 4.67 installations with only a single user action.
Affected Products
- IrfanView 4.67 (x64)
- IrfanView 4.67 (x86)
- Earlier IrfanView releases sharing the same JPM parser code path
Discovery Timeline
- 2024-11-22 - CVE-2024-11515 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11515
Vulnerability Analysis
The vulnerability is an out-of-bounds write [CWE-787] in IrfanView's JPM file parsing logic. JPM is a compound image container based on the JPEG 2000 Part 6 specification. During parsing, IrfanView fails to properly validate user-supplied length or offset values embedded in the file structure. The parser then writes attacker-controlled data past the end of an allocated heap buffer. This out-of-bounds write corrupts adjacent memory structures used by the process. An attacker can shape the corruption to hijack control flow and execute code under the user's privileges.
Root Cause
The root cause is missing bounds validation on fields read from untrusted JPM input. The parser trusts size or count values from the file header when determining how much data to copy into a buffer. Because the destination buffer size is not reconciled with these attacker-controlled fields, the copy operation writes past the buffer boundary. This is a classic input validation failure preceding a memory corruption primitive.
Attack Vector
Exploitation requires local file handling but no privileges or authentication. The attacker delivers a malicious .jpm file through email, chat, a compromised website, or a shared drive. The victim must open the file in IrfanView or trigger it through an association-based handler. Once parsed, the crafted structure fields drive the out-of-bounds write. Code executes in the context of the IrfanView process, inheriting the user's privileges on the workstation.
No verified public proof-of-concept code is available. See the Zero Day Initiative Advisory ZDI-24-1598 for vendor-coordinated technical details.
Detection Methods for CVE-2024-11515
Indicators of Compromise
- Unexpected i_view64.exe or i_view32.exe child processes such as cmd.exe, powershell.exe, or rundll32.exe shortly after a JPM file open.
- IrfanView process crashes with access violation exceptions referencing heap corruption when handling .jpm files.
- Inbound .jpm attachments or downloads from untrusted sources, particularly from external email or chat platforms.
Detection Strategies
- Monitor process lineage for IrfanView spawning interpreters, shells, or LOLBins that are unusual for an image viewer.
- Alert on IrfanView modules loading from user-writable directories or making outbound network connections.
- Inspect file-write events where IrfanView creates executables, scripts, or scheduled task artifacts on disk.
Monitoring Recommendations
- Ingest endpoint process, module load, and file telemetry into a centralized data lake for correlation and retrospective search.
- Track installed IrfanView versions across the fleet using software inventory and flag hosts running 4.67 or earlier.
- Enable crash and Windows Error Reporting collection for IrfanView to surface exploitation attempts that fail before code execution.
How to Mitigate CVE-2024-11515
Immediate Actions Required
- Update IrfanView to the latest version released after November 2024 that addresses the JPM parser flaw on both x86 and x64 builds.
- Remove file association for .jpm from IrfanView on endpoints that do not require JPM support.
- Block inbound .jpm attachments at the mail gateway and web proxy until patching is verified.
Patch Information
Refer to the Zero Day Initiative Advisory ZDI-24-1598 and the official IrfanView download page for the fixed release. Confirm the installed version through Help > About IrfanView and validate deployment through software inventory tooling. No vendor advisory URL was published in the NVD entry at the time of writing.
Workarounds
- Do not open JPM files from untrusted sources, including email attachments and unfamiliar web downloads.
- Restrict IrfanView execution to standard user accounts and enforce application allowlisting to limit follow-on payloads.
- Use a sandboxed viewer or convert JPM content to a safer format in an isolated environment before user access.
# Remove the .jpm file association on Windows endpoints
reg delete "HKCR\.jpm" /f
reg delete "HKCR\IrfanView.JPM" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
