CVE-2024-11950: XnView Classic RWZ File RCE Vulnerability

CVE-2024-11950 Overview

CVE-2024-11950 is an integer underflow vulnerability in XnSoft XnView Classic that enables remote code execution when a user opens a malicious RWZ file. The flaw resides in the RWZ file parsing routine, where user-supplied data is not properly validated before a memory write operation. Attackers can trigger the underflow to corrupt memory and execute arbitrary code in the context of the current process. Exploitation requires user interaction, such as opening a crafted file or visiting a malicious page that delivers the payload. The Zero Day Initiative tracked this issue as ZDI-CAN-22913 and published advisory ZDI-24-1640. The vulnerability is classified under CWE-191: Integer Underflow (Wrap or Wraparound).

Critical Impact
Successful exploitation grants arbitrary code execution in the security context of the user running XnView Classic, enabling full compromise of the affected workstation.

Affected Products

XnSoft XnView Classic 2.51.5
Windows installations processing RWZ image container files
Environments where XnView Classic is associated as a default image viewer

Discovery Timeline

2024-12-12 - CVE-2024-11950 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11950

Vulnerability Analysis

The vulnerability affects the RWZ file parsing logic inside XnView Classic. RWZ is a legacy raw image container format that stores metadata fields describing image dimensions, offsets, and embedded payload sizes. XnView Classic reads these fields directly from the file and uses them to compute buffer sizes and pointer offsets during decoding. When a size field is smaller than a fixed structural value the parser subtracts from it, the resulting arithmetic wraps below zero and produces a very large unsigned integer. That corrupted length is then used as the size argument for a memory write, causing an out-of-bounds write beyond the intended destination buffer. This memory corruption primitive can be shaped into arbitrary code execution using standard heap grooming and control-flow hijack techniques.

Root Cause

The root cause is missing bounds validation on attacker-controlled length fields inside the RWZ header structure. The parser assumes header values are consistent with the file layout and performs unchecked subtraction against them. Because the arithmetic is performed on unsigned integer types, an underflow produces an extremely large value rather than a negative number, which bypasses any implicit length sanity checks and is later trusted by the write operation.

Attack Vector

Exploitation is remote but requires user interaction. An attacker delivers a malicious RWZ file through email attachments, drive-by downloads, file-sharing platforms, or a web page that triggers automatic handler invocation. When the victim opens the file with XnView Classic, the malformed header fields trigger the integer underflow during parsing and give the attacker code execution as the current user. No authentication is required and the attack complexity is low.

No public proof-of-concept or in-the-wild exploitation has been reported. Technical details are described in the Zero Day Initiative Advisory ZDI-24-1640.

Detection Methods for CVE-2024-11950

Indicators of Compromise

Unexpected RWZ files delivered via email, chat, or web downloads to hosts running XnView Classic.
xnview.exe or xnviewmp.exe spawning child processes such as cmd.exe, powershell.exe, or rundll32.exe immediately after opening an image file.
Crash dumps or Windows Error Reporting entries referencing access violations inside XnView Classic image parsing modules.
Outbound network connections initiated by the XnView process to previously unseen hosts.

Detection Strategies

Alert on process lineage where XnView spawns shell interpreters, script hosts, or LOLBins that are inconsistent with normal image-viewing activity.
Monitor file system telemetry for RWZ files written to user download or temp directories, especially when followed by execution of XnView.
Correlate application crash events for XnView with subsequent process creation or persistence activity on the same host.

Monitoring Recommendations

Enable command-line and process-creation logging on endpoints that have XnView Classic installed.
Ingest email gateway and web proxy logs to inventory RWZ and other uncommon image formats reaching end users.
Track installed versions of XnView across the estate to identify hosts still running 2.51.5 or earlier.

How to Mitigate CVE-2024-11950

Immediate Actions Required

Upgrade XnView Classic to the latest vendor-released version once a patched build is available from XnSoft.
Remove XnView Classic from systems where it is not required for business operations.
Restrict file associations so RWZ and other rarely used image formats are not automatically opened by XnView.
Instruct users to avoid opening RWZ files received from untrusted sources.

Patch Information

No vendor advisory or fixed version is referenced in the NVD entry at the time of publication. Administrators should monitor the XnView download page and the Zero Day Initiative Advisory ZDI-24-1640 for updated build information. Until a patched release is confirmed, treat all installations of XnView Classic 2.51.5 as vulnerable.

Workarounds

Block inbound RWZ file attachments at the email gateway and web proxy layer.
Apply application control policies that prevent XnView from spawning shell or script interpreters.
Run XnView Classic under a low-privilege user account and enforce Windows exploit protections such as DEP and ASLR for the process.
Consider replacing XnView Classic with an alternative image viewer on high-risk endpoints until a fix is released.

bash

# Example Windows Defender Application Control rule to block RWZ handling by XnView
# Save as XnViewBlockRWZ.xml and deploy via Group Policy

<FileRules>
  <Deny ID="ID_DENY_XNVIEW_RWZ"
        FriendlyName="Block XnView Classic parsing of RWZ files"
        FileName="xnview.exe"
        MinimumFileVersion="0.0.0.0"
        MaximumFileVersion="2.51.5" />
</FileRules>