CVE-2024-6817: IrfanView PSP File Parsing RCE Vulnerability

CVE-2024-6817 Overview

CVE-2024-6817 is an out-of-bounds write vulnerability [CWE-787] in IrfanView, a widely used Windows image viewer. The flaw exists in the parser that handles Paint Shop Pro (PSP) image files. Attackers can trigger the vulnerability by convincing a user to open a crafted PSP file or visit a malicious page that delivers one. Successful exploitation results in arbitrary code execution in the context of the current user process. The issue was reported through Trend Micro's Zero Day Initiative as ZDI-CAN-23216 and disclosed in advisory ZDI-24-969.

Critical Impact
Opening a malicious PSP file in IrfanView allows attackers to execute arbitrary code with the privileges of the current user, enabling initial access and follow-on compromise of the host.

Affected Products

IrfanView 4.66 (x64) on Windows
Prior IrfanView releases that share the vulnerable PSP parser
Any IrfanView installation with PSP file handling enabled

Discovery Timeline

2024-11-22 - CVE-2024-6817 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6817

Vulnerability Analysis

The vulnerability resides in IrfanView's parsing routine for Paint Shop Pro (.psp) image files. The parser fails to properly validate user-supplied fields inside the PSP file before using them to compute buffer offsets and copy lengths. When a crafted PSP file supplies malformed size or chunk fields, the parser writes data past the end of an allocated buffer.

The out-of-bounds write [CWE-787] corrupts adjacent memory structures such as heap metadata, function pointers, or object vtables. An attacker who controls the overwritten data can hijack execution flow inside the IrfanView process. Exploitation runs code with the same privileges as the user who opened the file, which is typically an interactive desktop user.

Exploitation requires user interaction. The victim must open a malicious PSP file locally or navigate to a page that triggers IrfanView to render such a file. No network privileges or credentials are required on the target system.

Root Cause

The root cause is missing bounds validation of length and offset fields parsed from the PSP file header and chunk structures. IrfanView trusts attacker-controlled values when sizing writes into a fixed or heap-allocated buffer, allowing writes beyond the allocation boundary.

Attack Vector

The attack vector is local file processing with required user interaction. An attacker delivers a malicious .psp file through phishing email attachments, drive-by downloads, chat platforms, or shared file storage. When the victim opens the file in IrfanView, the vulnerable parser executes and the out-of-bounds write occurs. Attackers can chain this primitive with heap grooming to achieve reliable arbitrary code execution.

No public proof-of-concept exploit code is available at the time of writing. Technical details are documented in the Zero Day Initiative advisory ZDI-24-969.

Detection Methods for CVE-2024-6817

Indicators of Compromise

Unexpected child processes spawned by i_view64.exe or i_view32.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
Crashes or Windows Error Reporting (WER) entries referencing IrfanView with access violations during PSP file parsing.
Newly written executables, scripts, or scheduled tasks created shortly after a user opened a .psp file.
Inbound .psp attachments from untrusted senders or downloads from low-reputation domains.

Detection Strategies

Alert on IrfanView processes spawning shells, script interpreters, or LOLBins that are not part of normal image-viewing workflows.
Monitor for anomalous outbound network connections initiated by the IrfanView process after opening image files.
Inspect email and web gateways for .psp files and quarantine samples for sandbox detonation.
Track file-open telemetry that correlates PSP file access with subsequent process injection or memory allocation anomalies.

Monitoring Recommendations

Enable process creation, image load, and file write auditing on endpoints that have IrfanView installed.
Forward endpoint telemetry to a centralized data lake so PSP-related activity can be queried across the fleet.
Baseline normal IrfanView behavior and alert on deviations such as unexpected DLL loads or child processes.

How to Mitigate CVE-2024-6817

Immediate Actions Required

Update IrfanView to the latest version that addresses the PSP parsing flaw referenced in ZDI-24-969.
Inventory all endpoints running IrfanView 4.66 and prior, and prioritize patching on high-value or internet-facing user systems.
Block inbound .psp file attachments at email and web gateways until patching is complete.
Educate users to avoid opening PSP files from untrusted sources.

Patch Information

Refer to the Zero Day Initiative advisory ZDI-24-969 and the official IrfanView download page for the fixed release. Apply the vendor-supplied update to all affected installations. There is no evidence of exploitation in the wild, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Workarounds

Remove the file association for .psp files so they do not open in IrfanView by default.
Restrict IrfanView execution using application control policies such as Windows Defender Application Control or AppLocker on systems that cannot be patched immediately.
Open untrusted image files inside a sandboxed or virtualized environment isolated from production data.
Enforce least-privilege user accounts to limit the impact of code executed under the current user context.

bash

# Example: block .psp files at a Windows mail gateway using a transport rule (PowerShell)
New-TransportRule -Name "Block PSP Attachments" \
  -AttachmentExtensionMatchesWords "psp" \
  -RejectMessageReasonText "PSP file attachments are blocked pending CVE-2024-6817 remediation."