CVE-2024-11567 Overview
CVE-2024-11567 is an out-of-bounds read vulnerability [CWE-125] in IrfanView's DXF file parsing logic. The flaw allows attackers to execute arbitrary code in the context of the current user process. Exploitation requires a target user to open a crafted DXF file or visit a page that delivers one.
The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-24871 and published as ZDI-24-1575. IrfanView 4.67 on x86 and x64 builds is confirmed affected.
Critical Impact
An attacker who tricks a user into opening a malicious DXF file can achieve arbitrary code execution with the privileges of the IrfanView process.
Affected Products
- IrfanView 4.67 (x64)
- IrfanView 4.67 (x86)
- Prior IrfanView releases sharing the same DXF parser
Discovery Timeline
- 2024-11-22 - CVE-2024-11567 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-11567
Vulnerability Analysis
The vulnerability resides in IrfanView's parser for Drawing Exchange Format (DXF) files. DXF is a CAD interchange format containing structured group codes and variable-length records. The parser reads user-supplied fields without properly validating their size against the allocated buffer.
During processing, the code reads past the end of a heap or stack buffer. This out-of-bounds read exposes adjacent memory and can be shaped by an attacker to influence subsequent program state. Combined with predictable memory layouts, the primitive supports arbitrary code execution in the IrfanView process.
The attack requires local file handling, but the file itself can be delivered through email, a web download, or a network share. The attacker needs the target to open the file or preview it via a browser plugin or shell integration.
Root Cause
The root cause is missing bounds validation on user-controlled length or index fields inside the DXF record structure. The parser trusts values embedded in the file when computing read offsets. Trend ZDI classifies the primitive as an out-of-bounds read past the end of an allocated buffer.
Attack Vector
Exploitation is local from a CVSS perspective but user-initiated in practice. An attacker crafts a malicious .dxf file and delivers it via phishing, drive-by download, or a compromised file share. When the victim opens the file in IrfanView, the parser dereferences attacker-controlled offsets and disclosed memory can be reused to hijack control flow.
See the ZDI-24-1575 advisory for the reference disclosure. No public proof-of-concept exploit or working exploit code is currently available.
Detection Methods for CVE-2024-11567
Indicators of Compromise
- Unexpected i_view32.exe or i_view64.exe child processes spawning cmd.exe, powershell.exe, or scripting hosts
- IrfanView process crashes with access violations while opening .dxf files
- Inbound .dxf attachments or downloads from untrusted senders or domains
- Modifications to autorun registry keys or scheduled tasks created shortly after DXF file access
Detection Strategies
- Alert on IrfanView processes spawning shells, LOLBins, or network-capable interpreters
- Hunt for file writes to user startup and Temp directories immediately following an IrfanView process launch
- Correlate Windows Error Reporting or application crash events for i_view32.exe/i_view64.exe with recent DXF file access
Monitoring Recommendations
- Collect endpoint process, image load, and child-process telemetry for IrfanView binaries
- Monitor mail and web gateways for .dxf attachments and downloads to identify exposure
- Track outbound network connections initiated by IrfanView, which should typically be minimal
How to Mitigate CVE-2024-11567
Immediate Actions Required
- Inventory endpoints running IrfanView 4.67 or earlier, including both x86 and x64 builds
- Block or quarantine inbound .dxf files at email and web gateways until patched builds are deployed
- Remove file associations that automatically open DXF files in IrfanView on shared or high-risk workstations
- Educate users to avoid opening DXF files from untrusted sources
Patch Information
At the time of publication, the NVD entry lists no vendor advisory URL. Review the ZDI-24-1575 advisory and the IrfanView website for the latest release notes and upgrade guidance. Apply the newest IrfanView release addressing DXF parsing once it is available and validated.
Workarounds
- Uninstall IrfanView from systems that do not require DXF or image viewing capability
- Remove the DXF plugin from the IrfanView Plugins directory to disable parsing of the affected format
- Run IrfanView under a standard, non-privileged user account and apply Windows Defender Exploit Guard policies to constrain child-process creation
# Remove the IrfanView DXF plugin to eliminate the vulnerable parser path
del "C:\Program Files\IrfanView\Plugins\Cadimage.dll"
del "C:\Program Files (x86)\IrfanView\Plugins\Cadimage.dll"
# Remove .dxf file association for the current user
reg delete "HKCU\Software\Classes\.dxf" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
