CVE-2024-6815: IrfanView RLE File Parsing RCE Vulnerability

CVE-2024-6815 Overview

CVE-2024-6815 is an out-of-bounds write vulnerability [CWE-787] in IrfanView, a widely deployed Windows image viewer. The flaw exists in the parser for Run-Length Encoded (RLE) image files. IrfanView fails to properly validate user-supplied data, allowing an attacker to write past the end of an allocated buffer. Successful exploitation grants arbitrary code execution in the context of the current user.

The issue requires user interaction. A victim must open a crafted RLE file or visit a page that delivers one through an associated handler. The Zero Day Initiative tracks this bug as ZDI-CAN-23159 and published advisory ZDI-24-967.

Critical Impact
An attacker who convinces a user to open a malicious RLE file can execute arbitrary code with the privileges of the IrfanView process.

Affected Products

IrfanView 4.66 (x64)
IrfanView installations bundling the vulnerable RLE parser
Systems where IrfanView is registered as the default handler for RLE files

Discovery Timeline

2024-11-22 - CVE-2024-6815 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6815

Vulnerability Analysis

The vulnerability resides in IrfanView's routine that decodes Run-Length Encoded bitmap data. RLE compresses image data using count-value pairs, where a count byte drives how many pixels of a given color are written into the output buffer. The parser trusts count and offset fields from the input file without bounding them against the destination buffer size.

When a crafted RLE stream supplies oversized counts or attacker-controlled escape sequences, the decoder writes decoded pixel data beyond the allocated heap region. The corrupted memory can overwrite adjacent heap metadata, function pointers, or object vtables reachable during image rendering.

Exploitation converts the write primitive into control-flow hijack by manipulating heap layout before triggering the overflow. Attackers typically groom the heap through repeated allocations and then position controlled data adjacent to the vulnerable buffer.

Root Cause

The root cause is missing validation of length and offset fields decoded from the RLE stream before they are used as write indices. The parser calculates destination offsets from untrusted input without comparing them against the size of the pixel buffer returned by the earlier allocation.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a malicious .rle file through email attachments, drive-by downloads, or a web page that invokes an installed file handler. When the user opens the file in IrfanView, the parser triggers the out-of-bounds write and executes attacker-supplied shellcode.

See the Zero Day Initiative Advisory ZDI-24-967 for additional technical context.

Detection Methods for CVE-2024-6815

Indicators of Compromise

Unexpected child processes spawned by i_view64.exe or i_view32.exe, particularly cmd.exe, powershell.exe, or rundll32.exe
Crashes of IrfanView followed by unsigned binaries written to %TEMP% or %APPDATA%
RLE files delivered through email or download channels that exceed typical size or contain anomalous header fields

Detection Strategies

Monitor for anomalous process creation chains where IrfanView is the parent of scripting or shell interpreters
Alert on Windows Error Reporting entries citing access violations in the IrfanView image module during RLE processing
Correlate file open telemetry for .rle extensions with subsequent network egress from the IrfanView process

Monitoring Recommendations

Ingest endpoint process, file, and image-load telemetry into a centralized data lake for retroactive hunting on IrfanView activity
Track EDR alerts tagged to [CWE-787] out-of-bounds write patterns on client workstations that handle untrusted image files
Baseline legitimate IrfanView command lines and flag deviations, including unusual file paths passed as arguments

How to Mitigate CVE-2024-6815

Immediate Actions Required

Inventory endpoints for IrfanView 4.66 x64 installations using software asset management or endpoint queries
Update IrfanView to the latest vendor release that addresses the RLE parser flaw
Restrict the file handler association for .rle files until patched builds are deployed
Instruct users not to open RLE files received from untrusted sources

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-967 for vendor coordination details and the fixed version. Deploy the updated IrfanView package through standard software distribution channels and verify version strings post-installation.

Workarounds

Remove IrfanView from systems that do not require it, particularly high-value user workstations
Reassign the default handler for .rle files to a viewer not affected by this vulnerability
Block inbound .rle attachments at the email gateway and web proxy where feasible
Apply application control policies that prevent IrfanView from spawning shell or scripting interpreters

bash

# Example: remove RLE file association on Windows
assoc .rle=
cmd /c ftype rlefile=