CVE-2024-11517: IrfanView JPM File Parsing RCE Vulnerability

CVE-2024-11517 Overview

CVE-2024-11517 is an out-of-bounds write vulnerability in IrfanView's JPM file parser. The flaw allows attackers to execute arbitrary code in the context of the current user process. Exploitation requires the target to open a malicious JPM file or visit a page delivering one.

The vulnerability was reported through the Zero Day Initiative and tracked as ZDI-CAN-24118. It affects IrfanView 4.67 on both x86 and x64 builds. The weakness is classified as [CWE-787] Out-of-Bounds Write.

Critical Impact

Successful exploitation grants arbitrary code execution with the privileges of the user running IrfanView, enabling malware installation and lateral movement.

Affected Products

• IrfanView 4.67 (x64)
• IrfanView 4.67 (x86)
• Systems processing untrusted JPM (JPEG 2000 Part 6) files with IrfanView

Discovery Timeline

• 2024-11-22 - CVE-2024-11517 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11517

Vulnerability Analysis

The vulnerability resides in IrfanView's routine that parses JPM files, a container format defined by JPEG 2000 Part 6 for compound images. IrfanView fails to properly validate user-supplied data within the file structure before writing to a heap-allocated buffer. This mismatch between claimed and actual data sizes produces a write past the end of the buffer.

An attacker who controls the JPM file contents can control the out-of-bounds write. Overwriting adjacent memory such as function pointers, virtual table pointers, or heap metadata leads to arbitrary code execution. Because IrfanView runs in the user session, the resulting code executes with that user's privileges.

Exploitation is local and requires user interaction. A victim must open the crafted file directly or launch it from a browser, email attachment, or file share. No authentication is required from the attacker's side.

Root Cause

The root cause is missing length validation on fields within the JPM container before those values drive memory copies. The parser trusts sizes read from the file, allocates a buffer accordingly, and then writes attacker-controlled bytes beyond the allocation boundary.

Attack Vector

Attack delivery relies on social engineering. Attackers distribute weaponized JPM files through phishing, drive-by downloads, or compromised file-sharing platforms. Upon opening, IrfanView parses the malformed structure and triggers the out-of-bounds write inside the JPM handler. See the Zero Day Initiative Advisory ZDI-24-1597 for additional technical detail.

// No verified proof-of-concept code is publicly available.
// The vulnerability is triggered by a malformed JPM file causing
// IrfanView's parser to write beyond an allocated heap buffer.

Detection Methods for CVE-2024-11517

Indicators of Compromise

• JPM files (.jpm extension) received from untrusted sources, especially email attachments or unfamiliar downloads.
• Unexpected i_view32.exe or i_view64.exe process crashes recorded in Windows Application event logs.
• Child processes spawned by IrfanView such as cmd.exe, powershell.exe, or rundll32.exe following JPM file opens.

Detection Strategies

• Monitor endpoint telemetry for IrfanView processes loading unsigned modules or performing suspicious network connections after opening image files.
• Configure EDR rules to flag process tree anomalies where i_view32.exe or i_view64.exe spawn shells or scripting hosts.
• Inspect file gateways and email security tools for JPM attachments and detonate them in a sandbox before delivery.

Monitoring Recommendations

• Enable Windows Error Reporting and forward crash dumps involving IrfanView to a central log repository for review.
• Track file open events for .jpm, .jpx, and related JPEG 2000 container extensions through Sysmon Event ID 11.
• Correlate IrfanView execution with subsequent outbound connections to detect post-exploitation command-and-control traffic.

How to Mitigate CVE-2024-11517

Immediate Actions Required

• Upgrade IrfanView to a version later than 4.67 once the vendor publishes a fixed release. Verify the version in Help → About.
• Remove or restrict IrfanView on systems that regularly handle untrusted image files until patched.
• Train users to avoid opening JPM files from unverified sources and to report suspicious attachments.

Patch Information

At the time of publication, the Zero Day Initiative Advisory ZDI-24-1597 is the primary reference. Administrators should monitor the IrfanView website for an updated release addressing the JPM parser flaw and apply it across all endpoints.

Workarounds

• Remove the JPM file association from IrfanView so the application does not automatically parse these files.
• Block .jpm attachments at email gateways and web proxies to limit delivery of malicious payloads.
• Enforce application allowlisting and standard user privileges so that any successful exploitation runs with minimal rights.

# Remove the .jpm file association on Windows (run as Administrator)
assoc .jpm=
ftype JPMFile=