CVE-2024-11565 Overview
CVE-2024-11565 is an out-of-bounds read vulnerability [CWE-125] in IrfanView, a widely used Windows image viewer. The flaw resides in the parsing routine for Computer Graphics Metafile (CGM) files. Attackers can leverage the issue to execute arbitrary code in the context of the current user. Exploitation requires the victim to open a crafted CGM file or visit a page that delivers one. The Zero Day Initiative tracked the finding as ZDI-CAN-24866 and published advisory ZDI-24-1567.
Critical Impact
An attacker who convinces a user to open a malicious CGM file can execute arbitrary code with the privileges of the IrfanView process, leading to full user-context compromise.
Affected Products
- IrfanView 4.67 (x64)
- IrfanView 4.67 (x86)
- Installations processing CGM files through IrfanView plugins
Discovery Timeline
- 2024-11-22 - CVE-2024-11565 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11565
Vulnerability Analysis
The vulnerability lives in the code path that parses CGM files inside IrfanView. CGM is a vector graphics container format that stores structured graphical elements in binary or text form. IrfanView reads these structures through length and offset fields embedded in the file. When those fields are not validated against the size of the allocated buffer, the parser reads past the end of that buffer.
An attacker who controls the CGM file controls the values that drive the read. The out-of-bounds read exposes adjacent process memory and can be combined with additional primitives to achieve arbitrary code execution. Successful exploitation runs code with the privileges of the current user.
Root Cause
The root cause is missing bounds validation on user-supplied data inside the CGM parser. The parser trusts length or offset values from the file when calculating read positions. This condition is classified as CWE-125: Out-of-bounds Read.
Attack Vector
Exploitation requires user interaction. The victim must open a malicious CGM file in IrfanView or open a page that delivers such a file to a locally installed instance. The attack vector is local, and no privileges are required on the target beyond the ability to launch IrfanView with attacker-supplied content.
The vulnerability manifests during CGM structure parsing. Refer to the Zero Day Initiative Advisory ZDI-24-1567 for the vendor-coordinated technical description.
Detection Methods for CVE-2024-11565
Indicators of Compromise
- Unexpected i_view32.exe or i_view64.exe process crashes with access violation exceptions when opening CGM files
- CGM files (.cgm) delivered through email attachments, browser downloads, or removable media from untrusted sources
- IrfanView spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe after opening a CGM file
Detection Strategies
- Monitor process lineage where IrfanView is the parent of shells, scripting hosts, or LOLBins
- Alert on IrfanView process crashes with Windows Error Reporting entries referencing CGM plugin modules
- Inspect network egress or persistence changes that follow CGM file activity on endpoints running IrfanView 4.67
Monitoring Recommendations
- Log file open events for .cgm extensions across managed endpoints and correlate with IrfanView execution
- Track IrfanView version telemetry to identify hosts still running the vulnerable 4.67 release
- Feed endpoint process, file, and image-load events into a central data lake for retrospective hunting once a proof-of-concept is published
How to Mitigate CVE-2024-11565
Immediate Actions Required
- Upgrade IrfanView to a version later than 4.67 that addresses the CGM parsing flaw referenced in ZDI-24-1567
- Restrict opening of CGM files from untrusted sources until the update is deployed
- Remove or disable the CGM plugin from the IrfanView Plugins directory if the format is not required
Patch Information
Refer to the Zero Day Initiative Advisory ZDI-24-1567 for coordinated fix status. Deploy the latest IrfanView release from the official vendor site and confirm the CGM plugin version is updated alongside the main binary.
Workarounds
- Remove the CGM plugin file from the IrfanView plugins directory to eliminate the vulnerable parser
- Change the default handler for .cgm files to a non-vulnerable application or block the extension via file system policy
- Enforce application control rules that prevent IrfanView from spawning shell or scripting host processes
# Configuration example: remove the CGM plugin on Windows endpoints
# Adjust the path to match the IrfanView installation directory
del "C:\Program Files\IrfanView\Plugins\CGM.dll"
del "C:\Program Files (x86)\IrfanView\Plugins\CGM.dll"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
