CVE-2024-11535 Overview
CVE-2024-11535 is an out-of-bounds read vulnerability in IrfanView, a widely used Windows image viewer. The flaw exists in the parsing logic for Drawing Exchange Format (DXF) files. An attacker can craft a malicious DXF file that, when opened by a victim, triggers a read past the end of an allocated buffer. This condition can be leveraged to execute arbitrary code in the context of the current user process.
The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-24618 and tracked as advisory ZDI-24-1584. It is classified under CWE-125: Out-of-bounds Read.
Critical Impact
Attackers can achieve arbitrary code execution as the logged-in user by convincing that user to open a malicious DXF file in IrfanView.
Affected Products
- IrfanView 4.67 (x64)
- IrfanView 4.67 (x86)
- Installations processing DXF files through IrfanView plugins
Discovery Timeline
- 2024-11-22 - CVE-2024-11535 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11535
Vulnerability Analysis
The vulnerability resides in the IrfanView component responsible for parsing DXF files. DXF is an ASCII or binary CAD interchange format developed by Autodesk. IrfanView reads DXF structures to render preview images, and the parser fails to validate user-supplied length or offset fields before performing read operations.
When the parser processes a crafted DXF file, it reads memory beyond the boundary of an allocated buffer. Attackers can chain this out-of-bounds read with other primitives to disclose memory contents or corrupt program state. The result is arbitrary code execution in the context of the current process.
Exploitation requires local access with user interaction. The victim must open the malicious file or visit a page that delivers it. No prior authentication is required by the attacker.
Root Cause
The root cause is missing validation of user-supplied data within the DXF parsing routine. The parser trusts embedded size or index values from the file without verifying them against the actual buffer boundaries. This is a classic [CWE-125] out-of-bounds read condition.
Attack Vector
The attack vector is local and requires user interaction. An attacker delivers a weaponized DXF file through email attachments, web downloads, shared drives, or compromised websites. When the user opens the file with IrfanView, the parser triggers the out-of-bounds read and initiates the exploitation chain.
Technical exploitation details are documented in the Zero Day Initiative Advisory ZDI-24-1584. No public proof-of-concept code is currently available.
Detection Methods for CVE-2024-11535
Indicators of Compromise
- IrfanView process (i_view64.exe or i_view32.exe) crashing or spawning unexpected child processes after opening .dxf attachments
- DXF files arriving through email or web downloads from untrusted senders
- Unexpected outbound network connections initiated by the IrfanView process after file open
- Creation of new executables or scripts in user-writable directories following a DXF file open event
Detection Strategies
- Monitor endpoint telemetry for IrfanView process anomalies, including crashes, exception events, and child process creation
- Inspect email gateways and web proxies for inbound DXF file transfers and quarantine untrusted samples
- Correlate file-open events for DXF extensions with subsequent suspicious behavior on the host
Monitoring Recommendations
- Enable Windows Defender Exploit Guard or equivalent exploit mitigation logging for IrfanView
- Track versions of IrfanView deployed across the environment and flag installations at or below 4.67
- Alert on DXF files transiting file-sharing platforms and collaboration tools
How to Mitigate CVE-2024-11535
Immediate Actions Required
- Update IrfanView to a version released after 4.67 that addresses the DXF parsing flaw
- Restrict association of the .dxf file extension with IrfanView on endpoints that do not require DXF viewing
- Block or quarantine DXF attachments at email and web gateways for user populations that do not process CAD files
- Communicate the risk to end users and instruct them to avoid opening unsolicited DXF files
Patch Information
Refer to the Zero Day Initiative Advisory ZDI-24-1584 for vendor coordination status and the IrfanView downloads page for the latest release. Apply the vendor-supplied update to all affected IrfanView installations, including both x86 and x64 builds.
Workarounds
- Remove or disable the DXF parsing plugin from the IrfanView plugins directory if DXF support is not required
- Enforce application allowlisting to prevent unapproved IrfanView versions from executing
- Configure Attack Surface Reduction rules to block executable content spawned from Office or email clients
# Remove IrfanView DXF plugin (adjust path to your installation)
del "C:\Program Files\IrfanView\Plugins\Cadimage.dll"
# Remove file association for .dxf (run as Administrator)
assoc .dxf=
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
