CVE-2024-11531: IrfanView CGM File Parsing RCE Vulnerability

CVE-2024-11531 Overview

CVE-2024-11531 is an out-of-bounds read vulnerability in IrfanView that can lead to arbitrary code execution. The flaw exists in the parsing routine for Computer Graphics Metafile (CGM) files. Attackers can exploit this issue by delivering a crafted CGM file to a user who opens it in IrfanView. Successful exploitation runs code in the context of the current user process. The issue was reported through the Zero Day Initiative as ZDI-CAN-24606 and disclosed in advisory ZDI-24-1535.

Critical Impact
An attacker who convinces a user to open a malicious CGM file can execute arbitrary code with the privileges of the IrfanView process, leading to full compromise of the user context.

Affected Products

IrfanView 4.67 (x64)
IrfanView 4.67 (x86)
CGM file parsing component in IrfanView

Discovery Timeline

2024-11-22 - CVE-2024-11531 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11531

Vulnerability Analysis

The vulnerability resides in IrfanView's handler for Computer Graphics Metafile (CGM) images. IrfanView fails to properly validate user-supplied data during CGM parsing. The parser reads past the end of an allocated buffer, producing an out-of-bounds read condition classified as [CWE-125].

An attacker can shape the malicious file so that the out-of-bounds read leaks or corrupts data used in subsequent control-flow decisions. This condition can be leveraged to execute arbitrary code in the context of the IrfanView process. Exploitation requires user interaction: the target must open the malicious file or visit content that triggers the file open.

Root Cause

The root cause is missing bounds validation on fields inside the CGM file structure. IrfanView trusts length and offset values encoded in the metafile without confirming they remain within the bounds of the parsing buffer. When the parser dereferences these values, it reads memory outside the allocated region.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .cgm file through email, a web download, a network share, or an archive. When the user opens the file in IrfanView 4.67, the malformed CGM structure triggers the out-of-bounds read during parsing. The resulting memory corruption path can be used to hijack execution and run attacker-controlled code under the current user account.

No verified public proof-of-concept code is available. Technical details are documented in the Zero Day Initiative Advisory ZDI-24-1535.

Detection Methods for CVE-2024-11531

Indicators of Compromise

IrfanView process (i_view32.exe or i_view64.exe) opening .cgm files from user-writable locations such as %TEMP%, Downloads, or email attachment cache directories.
Unexpected child processes spawned by IrfanView, including cmd.exe, powershell.exe, or scripting hosts.
IrfanView process crashes with access violations tied to CGM file handling.

Detection Strategies

Alert on IrfanView processes making outbound network connections shortly after opening a CGM file.
Monitor for IrfanView writing executable content (.exe, .dll, .ps1) to disk after a file-open event.
Correlate email or browser download events that deliver .cgm files with subsequent IrfanView launches.

Monitoring Recommendations

Collect process creation and file-write telemetry from endpoints running IrfanView 4.67.
Enable Windows Error Reporting or crash dump collection to capture parser faults for triage.
Track prevalence of CGM files in email gateways and web proxies to identify unusual delivery patterns.

How to Mitigate CVE-2024-11531

Immediate Actions Required

Inventory endpoints running IrfanView 4.67 (x86 and x64) and prioritize patching.
Restrict opening of CGM files from untrusted sources until a fixed version is deployed.
Remove IrfanView as the default handler for .cgm files on systems that do not require it.

Patch Information

At the time of publication, no vendor advisory URL is listed in the CVE record. Refer to the Zero Day Initiative Advisory ZDI-24-1535 and the official IrfanView site for updated release information. Upgrade to the latest available IrfanView version once a fix addressing CGM parsing validation is published.

Workarounds

Block .cgm attachments at the email gateway and web proxy where feasible.
Change the default file association for .cgm to a viewer not affected by this issue.
Educate users to avoid opening CGM files received from unknown or untrusted senders.

bash

# Remove the .cgm file association for IrfanView on Windows (run as administrator)
assoc .cgm=
ftype IrfanView.CGM=