CVE-2024-11550: IrfanView DXF File Parsing RCE Vulnerability

CVE-2024-11550 Overview

CVE-2024-11550 is an out-of-bounds write vulnerability [CWE-787] in IrfanView, a widely used Windows image viewer. The flaw resides in the parser that processes Drawing Exchange Format (DXF) files. IrfanView fails to properly validate user-supplied data before writing it into an allocated buffer. Attackers can craft a malicious DXF file that, when opened by a user, corrupts memory and executes arbitrary code in the context of the current process. The Zero Day Initiative tracked this issue as ZDI-CAN-24748 and published advisory ZDI-24-1540.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user opening the DXF file, enabling full compromise of the local session.

Affected Products

IrfanView 4.67 (x64)
IrfanView 4.67 (x86)
Installations relying on the bundled DXF parsing component

Discovery Timeline

2024-11-22 - CVE-2024-11550 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11550

Vulnerability Analysis

The vulnerability resides in IrfanView's DXF file parser. DXF is a CAD interchange format containing structured text and binary sections that describe drawing entities. When IrfanView loads a DXF file, the parser reads attacker-controlled length or index values from the file and uses them to write into a fixed-size heap buffer. Because the parser does not validate these values against the destination buffer bounds, an attacker can trigger a write past the end of the allocation. This out-of-bounds write corrupts adjacent heap metadata or object pointers. A carefully constructed file can pivot control flow to attacker-supplied shellcode, delivering arbitrary code execution within the IrfanView process.

Root Cause

The root cause is missing input validation on DXF field values used to compute write offsets or sizes. The condition maps to [CWE-787] Out-of-bounds Write. IrfanView trusts the file-supplied metadata rather than enforcing bounds checks against the destination buffer capacity.

Attack Vector

Exploitation requires local user interaction. The victim must open a malicious DXF file in IrfanView or visit a page that delivers such a file. Common delivery methods include phishing attachments, drive-by downloads, or file share content. No authentication or elevated privileges are required on the target system. The resulting code runs with the privileges of the interactive user.

See the Zero Day Initiative Advisory ZDI-24-1540 for additional vendor-neutral technical details.

Detection Methods for CVE-2024-11550

Indicators of Compromise

Unexpected i_view32.exe or i_view64.exe child processes such as cmd.exe, powershell.exe, or rundll32.exe
IrfanView process crashes with access violations while parsing files with the .dxf extension
Inbound DXF files delivered via email attachments, browser downloads, or removable media to users who do not routinely handle CAD content
Outbound network connections initiated by the IrfanView process shortly after opening a DXF file

Detection Strategies

Monitor for suspicious process lineage where IrfanView spawns interpreters, script hosts, or LOLBins
Alert on IrfanView process termination events with exception codes consistent with heap corruption
Inspect file gateways and mail filters for DXF attachments and quarantine unexpected samples

Monitoring Recommendations

Enable command-line and process-creation logging on endpoints where IrfanView is installed
Correlate file-open telemetry with subsequent process, network, and registry activity for the IrfanView binary
Track IrfanView versions across the fleet and flag hosts still running the vulnerable 4.67 build

How to Mitigate CVE-2024-11550

Immediate Actions Required

Update IrfanView to a version later than 4.67 that addresses DXF parsing, per the Zero Day Initiative Advisory ZDI-24-1540
Restrict opening of DXF files from untrusted sources until patched
Remove IrfanView from systems that do not require image viewing capabilities
Enable Windows exploit protection features such as DEP and ASLR for the IrfanView executable

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1540 for the coordinated disclosure details. Verify the installed IrfanView version on all endpoints and upgrade to the vendor-supplied fixed release. No vendor advisory URL was published in the NVD record at the time of writing.

Workarounds

Unassociate the .dxf extension from IrfanView so files do not open automatically on double-click
Block DXF attachments at the email gateway for user populations that do not require CAD interchange files
Apply application allowlisting to prevent IrfanView from launching child processes such as shells or script interpreters
Run IrfanView under a standard user account with no local administrator rights to limit post-exploitation impact

bash

# Configuration example: remove the .dxf file association for IrfanView on Windows
reg delete "HKCU\Software\Classes\.dxf" /f
reg delete "HKCU\Software\Classes\IrfanView.DXF" /f
# Verify installed version
"%ProgramFiles%\IrfanView\i_view64.exe" /version