CVE-2024-11548: IrfanView DWG File Parsing RCE Vulnerability

CVE-2024-11548 Overview

CVE-2024-11548 is an out-of-bounds write vulnerability in IrfanView's DWG file parser. The flaw allows attackers to execute arbitrary code in the context of the current user process. Exploitation requires the target to open a crafted DWG file or visit a malicious page delivering one. The issue was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-24745 and tracks to [CWE-787]. IrfanView versions 4.67 for both x86 and x64 are affected.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user running IrfanView, enabling malware installation, data theft, or lateral movement.

Affected Products

IrfanView 4.67 (x64)
IrfanView 4.67 (x86)
Earlier IrfanView builds sharing the same DWG parsing logic

Discovery Timeline

2024-11-22 - CVE-2024-11548 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11548

Vulnerability Analysis

The vulnerability resides in IrfanView's routine that parses DWG (AutoCAD Drawing) files. IrfanView fails to properly validate size or offset fields sourced from the file before writing data into a heap-allocated buffer. When the attacker-controlled values exceed the destination buffer's capacity, the parser writes past the end of the allocation. This produces a classic out-of-bounds write condition classified as [CWE-787].

Exploitation requires user interaction. The victim must open a malicious .dwg file or navigate to a page that serves such a file to a browser plugin or file handler associated with IrfanView. Because IrfanView typically runs at medium integrity as the interactive user, code execution occurs in that same security context.

Root Cause

The root cause is missing bounds validation on user-supplied data inside the DWG parsing code path. Length or index values read from the file header or record structures are trusted without checking them against the allocated buffer size before memory writes.

Attack Vector

The attack vector is local because it depends on file open operations, though the malicious file can arrive through email, chat, or web download. An attacker crafts a DWG file with malformed size fields that steer the parser into writing controlled bytes beyond a heap buffer. Corrupting adjacent heap metadata or function pointers can be chained into arbitrary code execution. Refer to the Zero Day Initiative Advisory ZDI-24-1545 for additional context.

Detection Methods for CVE-2024-11548

Indicators of Compromise

Unexpected .dwg files opened by i_view32.exe or i_view64.exe originating from browser download folders, email attachment paths, or removable media.
Crash dumps referencing IrfanView's DWG parser plugin followed by process re-launch or child process spawning.
IrfanView spawning shells such as cmd.exe, powershell.exe, or scripting hosts shortly after opening a DWG file.

Detection Strategies

Monitor for IrfanView processes creating child processes that are inconsistent with normal image viewing behavior.
Alert on WER (Windows Error Reporting) faults in i_view32.exe/i_view64.exe involving access violations within DWG-related modules.
Hunt for DWG files delivered via phishing or downloaded from untrusted domains, correlating with subsequent IrfanView execution.

Monitoring Recommendations

Enable command-line and process-creation auditing on endpoints where IrfanView is installed.
Ingest EDR telemetry into a SIEM to correlate file-open events, process crashes, and suspicious child processes across the fleet.
Track outbound network connections initiated by IrfanView, which should be rare during normal use.

How to Mitigate CVE-2024-11548

Immediate Actions Required

Inventory all endpoints running IrfanView 4.67 or earlier and prioritize patching or removal.
Block inbound .dwg attachments at email gateways where such files are not required for business operations.
Instruct users not to open DWG files from untrusted sources until remediation is complete.

Patch Information

No vendor patch URL is listed in the NVD entry at the time of publication. Consult the Zero Day Initiative Advisory ZDI-24-1545 and the IrfanView download page for the latest release that supersedes 4.67. Upgrade all affected installations to the fixed version once available.

Workarounds

Uninstall IrfanView on systems where it is not business-critical.
Disassociate the .dwg file extension from IrfanView so double-click actions do not invoke the vulnerable parser.
Remove or rename the DWG parsing plugin DLL from the IrfanView Plugins directory to disable the affected code path.
Run IrfanView inside an application sandbox or restricted user account to limit impact of successful exploitation.

bash

# Remove the DWG plugin to disable the vulnerable parser (Windows PowerShell)
$plugin = "C:\Program Files\IrfanView\Plugins\Cad_dwg.dll"
if (Test-Path $plugin) { Rename-Item $plugin "$plugin.disabled" }

# Remove the .dwg file association from IrfanView
cmd /c "assoc .dwg="