CVE-2024-11549: IrfanView DXF File Parsing RCE Vulnerability

CVE-2024-11549 Overview

CVE-2024-11549 is an out-of-bounds write vulnerability [CWE-787] in IrfanView, a widely deployed Windows image viewer. The flaw resides in the parsing logic for AutoCAD Drawing Exchange Format (DXF) files. Attackers can trigger memory corruption by supplying a crafted DXF file to a targeted user. Successful exploitation results in arbitrary code execution in the context of the IrfanView process. Exploitation requires user interaction, either by opening a malicious file or visiting a page that delivers one. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-24746.

Critical Impact
Attackers who convince a user to open a malicious DXF file can execute arbitrary code with the privileges of the current user.

Affected Products

IrfanView 4.67 (x64)
IrfanView 4.67 (x86)

Discovery Timeline

2024-11-22 - CVE-2024-11549 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11549

Vulnerability Analysis

The vulnerability exists in IrfanView's DXF file parser. DXF is a text and binary interchange format used by CAD applications to represent 2D and 3D drawings. When IrfanView processes a DXF file, the parser fails to properly validate user-supplied data before writing it into a fixed-size buffer. The resulting out-of-bounds write corrupts adjacent memory structures. An attacker who controls the file contents can influence which bytes are written past the buffer boundary. This allows manipulation of program state and, ultimately, execution of attacker-controlled code within the IrfanView process.

Root Cause

The root cause is missing length validation on data extracted from DXF records prior to a memory copy operation. The parser trusts size or count fields embedded in the file rather than bounding writes against the allocated destination buffer. This classic input validation failure is categorized under CWE-787: Out-of-bounds Write.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malicious .dxf file and delivers it through email attachments, drive-by downloads, or shared file locations. When the victim opens the file in IrfanView, the parser processes the malformed structures and triggers the out-of-bounds write. Code execution occurs in the security context of the user running IrfanView. On workstations where users operate with administrative privileges, this can lead to full host compromise.

See the Zero Day Initiative Advisory ZDI-24-1547 for the original disclosure details.

Detection Methods for CVE-2024-11549

Indicators of Compromise

Unexpected .dxf files delivered via email attachments, chat platforms, or web downloads targeting endpoints with IrfanView installed.
IrfanView process (i_view32.exe or i_view64.exe) crashing or spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe.
Suspicious outbound network connections initiated by the IrfanView process shortly after opening a DXF file.

Detection Strategies

Monitor for process-tree anomalies where IrfanView launches command interpreters or scripting hosts.
Alert on IrfanView memory access violations recorded in the Windows Application event log.
Inspect email and web gateways for DXF attachments originating from untrusted senders.

Monitoring Recommendations

Enable command-line and process creation auditing (Windows Event ID 4688) on endpoints where IrfanView is installed.
Track file writes to user-writable directories immediately following DXF file access.
Correlate endpoint telemetry with mail and proxy logs to identify delivery vectors for malicious DXF payloads.

How to Mitigate CVE-2024-11549

Immediate Actions Required

Update IrfanView to a version later than 4.67 as soon as the vendor publishes a fix addressing the DXF parser.
Restrict or block DXF file attachments at email and web gateways for users who do not require CAD interchange formats.
Remove the .dxf file association from IrfanView on endpoints where the format is not needed.

Patch Information

No vendor advisory or patched version is referenced in the NVD entry at the time of publication. Administrators should track the IrfanView downloads page and the Zero Day Initiative Advisory ZDI-24-1547 for updates. Until a fix ships, treat all DXF files handled by IrfanView 4.67 (x86 and x64) as untrusted input.

Workarounds

Reassign the default handler for .dxf files to an application that does not use the vulnerable parser.
Enforce application allowlisting to prevent IrfanView from spawning shells or script interpreters as child processes.
Run IrfanView under a standard user account and enable Windows Defender Exploit Guard mitigations such as Data Execution Prevention (DEP) and Control Flow Guard (CFG).

bash

# Remove the .dxf file association for IrfanView on Windows (run as administrator)
reg delete "HKCR\.dxf" /f
assoc .dxf=