CVE-2024-11545: IrfanView DXF Parsing RCE Vulnerability

CVE-2024-11545 Overview

CVE-2024-11545 is a use-after-free vulnerability in IrfanView affecting the parsing of DXF (Drawing Exchange Format) files. The flaw stems from the application performing operations on an object without first validating that the object still exists. An attacker who convinces a user to open a crafted DXF file can execute arbitrary code in the context of the current process. This issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-24709 and published as ZDI-24-1542. The vulnerability is classified under CWE-416: Use After Free.

Critical Impact
Successful exploitation permits arbitrary code execution with the privileges of the user running IrfanView, potentially compromising the local system.

Affected Products

IrfanView 4.67 (x64)
IrfanView 4.67 (x86)
DXF file parsing component

Discovery Timeline

2024-11-22 - CVE-2024-11545 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11545

Vulnerability Analysis

CVE-2024-11545 is a use-after-free memory corruption issue triggered while IrfanView parses DXF files. DXF is a CAD interchange format developed by Autodesk, and IrfanView supports it through its plugin ecosystem. During parsing, the application dereferences an object reference without confirming that the underlying object is still valid. When the freed object is reused, attacker-controlled data can occupy the previously allocated memory region, allowing manipulation of function pointers or virtual table entries.

Exploitation requires user interaction. The victim must open a malicious DXF file or visit a page that delivers one. Because the process runs with the current user's privileges, code execution provides the same access level as the logged-on user.

Root Cause

The root cause is the absence of an existence check on an object prior to operating on it inside the DXF parsing routine. When the object has been released or was never fully initialized, subsequent method calls and memory reads dereference a stale pointer. This condition maps to CWE-416 and is a common source of exploitable memory corruption in file format parsers.

Attack Vector

The attack requires local file access with user interaction. An attacker crafts a malicious .dxf file and delivers it through email attachments, drive-by downloads, or shared network locations. When the user opens the file in IrfanView, the parser triggers the use-after-free and can transfer execution to attacker-supplied shellcode. Refer to the Zero Day Initiative Advisory ZDI-24-1542 for additional technical context.

Detection Methods for CVE-2024-11545

Indicators of Compromise

Unexpected i_view32.exe or i_view64.exe process crashes referencing access violations in DXF parsing modules
Child processes spawned from IrfanView such as cmd.exe, powershell.exe, or rundll32.exe after opening a .dxf file
.dxf files delivered from untrusted email attachments, external drives, or unfamiliar network shares
Outbound network connections initiated by IrfanView shortly after opening image or CAD files

Detection Strategies

Monitor endpoint telemetry for IrfanView processes performing file writes, registry modifications, or process creation outside of expected image-viewing behavior
Alert on Windows Error Reporting entries and application crash dumps that show exceptions inside IrfanView DXF plugin code
Correlate file open events for .dxf extensions with subsequent anomalous process activity across the user session

Monitoring Recommendations

Enable file auditing on shared directories where DXF files may be introduced by external users
Ingest Sysmon Event ID 1 (process create) and Event ID 11 (file create) into your SIEM to establish an IrfanView behavior baseline
Track installed IrfanView versions across the estate to identify hosts running 4.67 or earlier

How to Mitigate CVE-2024-11545

Immediate Actions Required

Update IrfanView to a version released after 4.67 that addresses the DXF parsing use-after-free
Restrict opening of DXF files to trusted sources, and block .dxf attachments at the email gateway where operationally feasible
Remove or disable the DXF format plugin in IrfanView if DXF viewing is not required
Apply the principle of least privilege so IrfanView runs under standard user accounts rather than administrative accounts

Patch Information

No vendor patch URL is listed in the NVD entry at the time of publication. Consult the Zero Day Initiative Advisory ZDI-24-1542 and the IrfanView website for the latest available build and release notes addressing this vulnerability.

Workarounds

Unregister the DXF plugin by removing the associated DLL from the IrfanView Plugins directory
Change the default handler for .dxf files to an application not affected by this vulnerability
Deploy application control policies that prevent IrfanView from spawning script interpreters or shell processes

bash

# Example: block .dxf attachments at an email gateway rule (pseudo-config)
rule "Block DXF attachments" {
  match attachment.extension == "dxf"
  action quarantine
  notify security-ops@example.com
}