CVE-2024-11568: IrfanView DXF File Parsing RCE Vulnerability

CVE-2024-11568 Overview

CVE-2024-11568 is an out-of-bounds read vulnerability [CWE-125] in IrfanView that allows attackers to execute arbitrary code on affected installations. The flaw resides in the parser for Drawing Exchange Format (DXF) files. Exploitation requires user interaction: the target must open a malicious DXF file or visit a page that delivers one. Successful exploitation results in code execution in the context of the current user process. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-24872 and published in advisory ZDI-24-1563.

Critical Impact
Attackers can achieve arbitrary code execution on Windows systems running IrfanView 4.67 (x86 and x64) when a user opens a crafted DXF file.

Affected Products

IrfanView 4.67 (x64)
IrfanView 4.67 (x86)
Systems where IrfanView is registered to handle DXF files

Discovery Timeline

2024-11-22 - CVE-2024-11568 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11568

Vulnerability Analysis

The vulnerability exists in IrfanView's DXF file parser. DXF is a CAD interchange format authored by Autodesk, and IrfanView processes it through a plugin that reads structured records from the input file. The parser fails to properly validate user-supplied data before performing read operations against an allocated buffer. When a malformed DXF file supplies crafted length or index values, the parser reads past the end of the buffer.

An attacker who controls the out-of-bounds read can leak adjacent memory contents or steer subsequent parsing decisions. Combined with additional primitives, this can be leveraged to execute arbitrary code in the context of the IrfanView process. Because IrfanView runs with the privileges of the invoking user, code execution inherits those rights and any tokens the user holds.

Root Cause

The root cause is missing bounds validation on user-supplied fields within a DXF record. The parser trusts values embedded in the file when calculating read offsets, allowing reads beyond the allocated buffer. This class of defect is tracked as CWE-125: Out-of-bounds Read.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted .dxf file through email, a download, a shared drive, or a web page that triggers a file association. When the victim opens the file in IrfanView, the malformed DXF triggers the out-of-bounds read during parsing. See the Zero Day Initiative Advisory ZDI-24-1563 for additional technical context.

No verified proof-of-concept code is publicly available. The vulnerability is described in prose per the ZDI advisory referenced above.

Detection Methods for CVE-2024-11568

Indicators of Compromise

Unexpected .dxf files delivered by email attachments, downloads, or removable media, particularly to users who do not routinely handle CAD data.
Crash events or Windows Error Reporting entries referencing i_view32.exe, i_view64.exe, or the DXF plugin module.
Child processes spawned by IrfanView such as cmd.exe, powershell.exe, rundll32.exe, or unsigned binaries launched from user-writable directories.

Detection Strategies

Alert on IrfanView opening files from download folders, temporary directories, or email client cache locations immediately followed by process creation.
Hunt for anomalous outbound network connections initiated by the IrfanView process, which under normal use is not a network client.
Correlate file open telemetry with abnormal memory access faults to identify exploitation attempts even without a successful payload.

Monitoring Recommendations

Track IrfanView versions across the fleet through software inventory to identify hosts running 4.67 or earlier.
Log DXF file writes and executions across endpoints, especially where users are not expected to process CAD content.
Monitor for suspicious parent-child process chains where IrfanView is the parent of scripting or living-off-the-land binaries.

How to Mitigate CVE-2024-11568

Immediate Actions Required

Update IrfanView to the version released after 4.67 that addresses the DXF parser flaw per the ZDI-24-1563 advisory.
Remove or restrict the DXF plugin (DXF.dll within the IrfanView Plugins directory) on systems that do not require CAD file support.
Instruct users not to open unsolicited .dxf files and to verify sender identity for any CAD content received externally.

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1563 and the IrfanView website for the fixed release. Verify installed version and plugin package version after applying the update, and redeploy through your software distribution channel to ensure all endpoints receive the fix.

Workarounds

Remove the DXF plugin from the IrfanView Plugins folder to eliminate the vulnerable parsing path when the format is not needed.
Reassign the default handler for .dxf files to an application that is not affected, or block the extension at the mail gateway.
Run IrfanView under a low-privilege user account and apply application control policies to restrict child process creation.

bash

# Configuration example: remove the vulnerable DXF plugin on Windows endpoints
# Run in an elevated PowerShell session
$plugin = "$env:ProgramFiles\IrfanView\Plugins\DXF.dll"
if (Test-Path $plugin) {
    Remove-Item -Path $plugin -Force
    Write-Host "DXF plugin removed from $plugin"
} else {
    Write-Host "DXF plugin not present"
}