CVE-2024-11555 Overview
CVE-2024-11555 is an out-of-bounds write vulnerability [CWE-787] in IrfanView's DXF file parser. The flaw allows attackers to execute arbitrary code in the context of the current user process. Exploitation requires user interaction: the target must open a crafted DXF file or visit a page that delivers one. The issue was reported through the Zero Day Initiative as ZDI-CAN-24780 and disclosed in advisory ZDI-24-1559.
Critical Impact
Attackers who convince a user to open a malicious DXF file can execute arbitrary code with the privileges of the IrfanView process, leading to full compromise of the user session.
Affected Products
- IrfanView 4.67 (x64)
- IrfanView 4.67 (x86)
- Earlier IrfanView builds containing the same DXF parsing logic
Discovery Timeline
- 2024-11-22 - CVE-2024-11555 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11555
Vulnerability Analysis
The vulnerability resides in IrfanView's handling of Drawing Exchange Format (DXF) files. IrfanView parses DXF input without properly validating attacker-controlled size or index values from the file structure. When the parser writes derived data into a fixed-size heap buffer, it advances past the allocation boundary. The resulting out-of-bounds write corrupts adjacent heap memory, which an attacker can shape to overwrite function pointers, virtual tables, or heap metadata. Successful exploitation yields arbitrary code execution inside the IrfanView process, giving the attacker access to any file or credential available to the current user.
Root Cause
The root cause is missing bounds validation on user-supplied fields inside the DXF stream. IrfanView trusts length or offset descriptors embedded in the file rather than comparing them against the target buffer capacity, so a malformed DXF causes the parser to write past the end of the allocated buffer.
Attack Vector
Exploitation requires local file access and user interaction. An attacker delivers a weaponized .dxf file through email attachment, drive-by download, chat, or removable media. When the victim opens the file in IrfanView, the malicious DXF triggers the out-of-bounds write and hijacks execution. See the Zero Day Initiative Advisory ZDI-24-1559 for the technical details of the flaw.
Detection Methods for CVE-2024-11555
Indicators of Compromise
- Unexpected child processes spawned by i_view32.exe or i_view64.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
- IrfanView process crashes or Windows Error Reporting entries referencing access violations while opening .dxf files.
- Inbound .dxf files from untrusted email senders or download sources followed by user open events.
Detection Strategies
- Alert on IrfanView process trees that launch scripting hosts, shells, or LOLBins immediately after opening a DXF file.
- Hunt for outbound network connections initiated by the IrfanView process, which does not normally require network egress.
- Inspect DXF files at the mail or web proxy for anomalous section sizes and offsets that deviate from the Autodesk DXF specification.
Monitoring Recommendations
- Enable Windows command-line and process-creation auditing (Event ID 4688) with parent-process logging on workstations that have IrfanView installed.
- Forward endpoint telemetry, including image loads and memory-write anomalies, into a central data lake for retrospective hunting against known IrfanView paths.
- Track IrfanView installations and versions across the fleet to identify hosts running the vulnerable 4.67 build.
How to Mitigate CVE-2024-11555
Immediate Actions Required
- Update IrfanView to a version released after 4.67 that addresses the DXF parsing flaw.
- Restrict IrfanView from opening DXF files originating outside the organization until patched.
- Enforce Attack Surface Reduction rules that block Office and browser processes from launching IrfanView with attacker-supplied files.
Patch Information
No vendor advisory URL is listed in the NVD record. Refer to the Zero Day Initiative Advisory ZDI-24-1559 and the IrfanView download page for the latest fixed release. Deploy the updated installer to all endpoints running IrfanView 4.67 on both x86 and x64 platforms.
Workarounds
- Remove the .dxf file association from IrfanView until the patched build is deployed.
- Use Windows Defender Application Control or AppLocker to prevent IrfanView from spawning child processes such as cmd.exe and powershell.exe.
- Route incoming .dxf attachments through a sandbox or dedicated CAD workstation isolated from user endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
