CVE-2024-11559: IrfanView DXF File Parsing RCE Vulnerability

CVE-2024-11559 Overview

CVE-2024-11559 is an out-of-bounds write vulnerability in IrfanView, a widely deployed image viewer for Windows. The flaw resides in the DXF file parsing logic and enables arbitrary code execution in the context of the current user. Exploitation requires user interaction: a target must open a crafted DXF file or visit a page that delivers one. The issue was reported through the Zero Day Initiative as ZDI-CAN-24809 and disclosed in advisory ZDI-24-1558. It is classified under [CWE-787] (Out-of-Bounds Write) and carries a CVSS 3.1 base score of 7.8.

Critical Impact
An attacker who convinces a user to open a malicious DXF file can execute arbitrary code with the privileges of the IrfanView process.

Affected Products

IrfanView 4.67 (x64)
IrfanView 4.67 (x86)
Installations processing DXF files through IrfanView plugins

Discovery Timeline

2024-11-22 - CVE-2024-11559 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11559

Vulnerability Analysis

The vulnerability exists in IrfanView's DXF file parser. DXF (Drawing Exchange Format) is an AutoCAD interchange format that IrfanView supports through its plugin architecture. When the parser processes attacker-controlled fields inside a DXF file, it writes data beyond the end of a heap-allocated buffer.

An attacker can shape the malformed DXF structure to overwrite adjacent memory. This corruption can be steered into control-flow hijacking, ultimately yielding arbitrary code execution in the IrfanView process. Because IrfanView typically runs with the invoking user's privileges, successful exploitation grants attacker code the same access as that user.

The attack chain is local per the CVSS vector but is realistic in phishing and drive-by scenarios. Malicious DXF files can be delivered as email attachments, downloaded from web pages, or placed on file shares. The EPSS score is approximately 0.42%, indicating low observed exploitation probability at present.

Root Cause

The root cause is missing validation of length or offset fields supplied inside the DXF file. The parser trusts attacker-supplied sizes and writes past the end of an allocated buffer, a classic [CWE-787] pattern.

Attack Vector

An attacker crafts a DXF file with malformed structural fields and delivers it to a target. When the user opens the file in IrfanView, or previews it through a shell integration, the parser triggers the out-of-bounds write and executes attacker-controlled code.

The vulnerability manifests in the DXF parser when handling attacker-supplied
field sizes. No verified public proof-of-concept code is available. See the
ZDI advisory ZDI-24-1558 for additional technical detail.

Detection Methods for CVE-2024-11559

Indicators of Compromise

Unexpected DXF files arriving via email, chat, or download from untrusted sources
IrfanView process (i_view64.exe or i_view32.exe) spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe
Crash dumps or Windows Error Reporting entries referencing IrfanView DXF plugin modules
Outbound network connections initiated by the IrfanView process shortly after opening a document

Detection Strategies

Hunt for process lineage where i_view64.exe or i_view32.exe is the parent of a shell, scripting host, or LOLBin
Alert on IrfanView loading unexpected DLLs or writing executable content to user-writable directories
Inspect email and web gateway telemetry for DXF attachments from external senders

Monitoring Recommendations

Enable command-line and image-load logging on endpoints running IrfanView
Forward endpoint telemetry to a centralized analytics platform for correlation across users and hosts
Track version inventory of IrfanView deployments to identify unpatched instances

How to Mitigate CVE-2024-11559

Immediate Actions Required

Update IrfanView and all associated plugins to the latest available version released after 4.67
Block inbound DXF attachments at email and web gateways where the format is not business-critical
Restrict file associations so DXF files do not open automatically in IrfanView from untrusted locations
Educate users to avoid opening DXF files from unknown senders

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1558 and the IrfanView download site for updated releases and plugin packages. Apply the vendor's latest DXF plugin update to remediate the out-of-bounds write.

Workarounds

Remove or disable the DXF plugin from the IrfanView plugin directory if DXF support is not required
Disassociate the .dxf extension from IrfanView on managed endpoints
Enforce application allowlisting to prevent IrfanView from spawning shells or scripting hosts

bash

# Remove DXF plugin from a managed IrfanView installation (Windows, run as admin)
del "C:\Program Files\IrfanView\Plugins\Dxf.dll"
del "C:\Program Files (x86)\IrfanView\Plugins\Dxf.dll"

# Remove .dxf file association for the current user
reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dxf" /f