CVE-2024-11561: IrfanView DXF Parsing RCE Vulnerability

CVE-2024-11561 Overview

CVE-2024-11561 is an out-of-bounds read vulnerability [CWE-125] in IrfanView, a widely deployed Windows image viewer. The flaw exists in the parser that processes AutoCAD Drawing Exchange Format (DXF) files. Insufficient validation of user-supplied data allows a crafted DXF file to trigger a read past the end of an allocated buffer. Attackers can leverage this condition to execute arbitrary code in the context of the current user. Exploitation requires user interaction: the victim must open a malicious DXF file or visit a page that delivers one. The Zero Day Initiative tracks this issue as ZDI-CAN-24857 and published advisory ZDI-24-1577.

Critical Impact
A single malicious DXF file opened in IrfanView can grant an attacker code execution as the current user, leading to full compromise of the workstation and any accessible data.

Affected Products

IrfanView 4.67 (x64)
IrfanView 4.67 (x86)
Installations relying on the bundled DXF file parser

Discovery Timeline

2024-11-22 - CVE-2024-11561 published to NVD
2026-06-17 - Last updated in NVD database
Vendor advisory reference: Zero Day Initiative Advisory ZDI-24-1577

Technical Details for CVE-2024-11561

Vulnerability Analysis

The vulnerability resides in the routine IrfanView uses to parse DXF files. DXF is a text or binary CAD interchange format containing section, table, and entity records with length-prefixed fields. When IrfanView reads one of these fields, the parser trusts a value derived from the file without confirming that subsequent reads remain inside the allocated buffer.

During processing, the parser advances a pointer beyond the buffer boundary and reads adjacent process memory. That out-of-bounds data influences later parsing decisions and control-flow structures held on the heap. An attacker who shapes the surrounding memory can steer the parser into using attacker-influenced values as pointers or object metadata, producing arbitrary code execution in the IrfanView process.

Root Cause

The root cause is missing bounds checking during DXF field parsing. IrfanView allocates a buffer sized from an early header value but later reads records without validating that the current offset plus the record size remain within that allocation. This meets the definition of [CWE-125] Out-of-Bounds Read and is characteristic of file parsers written without hardened deserialization primitives.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted .dxf file through email, chat, a drive-by download, or a shared network location. When the user opens the file in IrfanView, or associates DXF with IrfanView and previews it, the parser executes the malicious payload. No authentication or elevated privileges are needed on the target host.

Exploitation code is not publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details describing the parsing flaw are documented in the Zero Day Initiative Advisory ZDI-24-1577.

Detection Methods for CVE-2024-11561

Indicators of Compromise

Unexpected i_view32.exe or i_view64.exe child processes such as cmd.exe, powershell.exe, or rundll32.exe.
IrfanView process crashes referencing access violations while a .dxf file is open.
DXF files arriving from untrusted email attachments or downloads to user profile paths such as %USERPROFILE%\Downloads.

Detection Strategies

Alert on IrfanView spawning interpreters, script hosts, or LOLBins, which are not part of normal image-viewing behavior.
Hunt for outbound network connections initiated by IrfanView processes shortly after DXF file access.
Correlate Windows Error Reporting events (Application Error, faulting module) tied to IrfanView with recent DXF file activity.

Monitoring Recommendations

Log file-open telemetry for .dxf extensions and track handlers invoked to open them.
Monitor endpoint EDR telemetry for memory-access violations inside i_view32.exe/i_view64.exe.
Track IrfanView version inventory across managed endpoints to identify hosts running 4.67 or earlier.

How to Mitigate CVE-2024-11561

Immediate Actions Required

Update IrfanView to the latest version released after ZDI-24-1577, which addresses the DXF parser flaw.
Remove or disable the DXF plug-in from IrfanView installations that do not need CAD file support.
Block inbound .dxf attachments at the email gateway if DXF handling is not a business requirement.
Educate users to avoid opening DXF files from untrusted sources.

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1577 for coordinated disclosure details and to the IrfanView download page for the fixed release. Confirm that both the main executable and the plug-ins pack are upgraded, since DXF support ships as a plug-in.

Workarounds

Remove the DXF plug-in file from the IrfanView Plugins directory to prevent the vulnerable code path from loading.
Disassociate the .dxf file extension from IrfanView and route it to a hardened CAD viewer.
Run IrfanView under a low-privilege standard user account with Windows Defender Exploit Protection enabled for i_view32.exe and i_view64.exe.

bash

# Configuration example: remove the DXF plugin on managed Windows endpoints
del "%ProgramFiles%\IrfanView\Plugins\DXF.dll"
del "%ProgramFiles(x86)%\IrfanView\Plugins\DXF.dll"