CVE-2024-6812: IrfanView WSQ File Parsing RCE Vulnerability

CVE-2024-6812 Overview

CVE-2024-6812 is an out-of-bounds write vulnerability in IrfanView's WSQ (Wavelet Scalar Quantization) file parser. The flaw allows remote attackers to execute arbitrary code on affected installations when a user opens a malicious WSQ file or visits a page that delivers one. The issue stems from insufficient validation of user-supplied data during WSQ image parsing, permitting writes past the end of an allocated buffer. Zero Day Initiative tracked the finding as ZDI-CAN-23273 and published advisory ZDI-24-904. Code executes in the context of the current process, giving the attacker the privileges of the user running IrfanView.

Critical Impact
Successful exploitation yields arbitrary code execution in the context of the IrfanView process, enabling malware installation, credential theft, and lateral pivoting from user endpoints.

Affected Products

IrfanView 4.67 (x86)
IrfanView WSQ plugin 2024.02.16 (x64)
Installations with the WSQ image format plugin enabled

Discovery Timeline

2024-08-21 - CVE-2024-6812 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6812

Vulnerability Analysis

The vulnerability resides in IrfanView's WSQ file parsing logic, implemented through the WSQ plugin. WSQ is a fingerprint image compression format standardized by the FBI. When IrfanView processes a crafted WSQ file, the parser fails to validate size fields controlled by the attacker before writing decoded data into a heap buffer. The result is an out-of-bounds write classified under [CWE-787]. Exploitation requires user interaction because a victim must open the malicious file or navigate to a page that triggers file handling. Once triggered, the write can corrupt adjacent heap structures and redirect execution to attacker-controlled code.

Root Cause

The root cause is missing bounds validation on values read from the WSQ file header or compressed payload before they are used to size or index a destination buffer. Because the plugin trusts attacker-supplied length or dimension fields, decoded data overruns the allocated buffer during copy operations. This aligns with the CWE-787 pattern of writing outside the intended memory boundary.

Attack Vector

Attack delivery is local from the CVSS perspective, but practical delivery is remote. An attacker distributes a malicious .wsq file through email, a compromised website, or a drive-by download. When the victim opens the file in IrfanView, or double-clicks it after IrfanView is registered as the WSQ handler, the parser processes the payload and triggers the out-of-bounds write. No authentication is required. See the Zero Day Initiative Advisory ZDI-24-904 for additional technical detail.

Detection Methods for CVE-2024-6812

Indicators of Compromise

Unexpected i_view32.exe or i_view64.exe child processes spawning command shells, powershell.exe, or rundll32.exe.
IrfanView crashes recorded in the Windows Application event log referencing the WSQ plugin DLL.
Inbound .wsq files delivered via email attachments, chat platforms, or web downloads from untrusted sources.
Outbound network connections initiated by the IrfanView process shortly after opening an image file.

Detection Strategies

Monitor process ancestry for IrfanView launching interpreters, LOLBins, or persistence utilities.
Alert on WSQ files written to user directories from browser or mail client processes.
Correlate IrfanView crash events with subsequent suspicious child process creation on the same host.

Monitoring Recommendations

Ingest endpoint process, file, and image-load telemetry into a centralized analytics platform for retrospective hunting.
Track version data for IrfanView and its plugins across the fleet to identify hosts still exposed.
Baseline normal IrfanView behavior so plugin-triggered anomalies stand out.

How to Mitigate CVE-2024-6812

Immediate Actions Required

Update IrfanView and the WSQ plugin to the latest versions published after IrfanView 4.67 and WSQ 2024.02.16.
Remove or disable the WSQ plugin on hosts that do not require fingerprint image processing.
Block inbound .wsq attachments at the mail gateway and web proxy.
Restrict IrfanView execution to standard user accounts to limit blast radius after compromise.

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-904 and the IrfanView download page for the fixed release. Deploy the update to all endpoints where IrfanView is installed, and verify the WSQ plugin DLL version after installation.

Workarounds

Uninstall the WSQ plugin if fingerprint image support is not required.
Remove the .wsq file association from IrfanView to prevent double-click execution.
Apply application allowlisting rules that block execution of .wsq files from user-writable directories.

bash

# Remove the WSQ plugin DLL from a Windows endpoint (adjust path for install location)
del "C:\Program Files\IrfanView\Plugins\Wsq.dll"

# Remove the .wsq file association
assoc .wsq=