CVE-2024-6818: IrfanView PSP File Parsing RCE Vulnerability

CVE-2024-6818 is a remote code execution vulnerability in IrfanView that exploits PSP file parsing through an out-of-bounds write flaw. Attackers can execute arbitrary code when users open malicious files. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-6818 Overview

CVE-2024-6818 is an out-of-bounds write vulnerability [CWE-787] in IrfanView's PSP file parsing logic. The flaw allows attackers to execute arbitrary code in the context of the current user process. Exploitation requires user interaction: the victim must open a malicious PSP file or visit a page delivering one. The vulnerability was reported through the Zero Day Initiative as ZDI-CAN-23217 and disclosed publicly as ZDI-24-970. IrfanView is a widely deployed Windows image viewer, expanding the potential target population for social-engineering-based attacks.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the user running IrfanView, enabling malware installation, data theft, or lateral movement.

Affected Products

IrfanView 4.66 (x64)
IrfanView installations processing Paint Shop Pro (PSP) image files
Windows systems with IrfanView configured as default image handler

Discovery Timeline

2024-11-22 - CVE-2024-6818 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6818

Vulnerability Analysis

The vulnerability resides in IrfanView's parser for Paint Shop Pro (PSP) image files. IrfanView fails to properly validate user-supplied data from the PSP file structure before performing memory write operations. This lack of validation allows a crafted PSP file to trigger a write past the end of an allocated buffer. Because the write occurs in the process heap, attackers can corrupt adjacent memory structures, function pointers, or object metadata. Controlled corruption of these structures leads to arbitrary code execution within the IrfanView process. The attack is local in scope but network-deliverable through email attachments, drive-by downloads, or malicious archives.

Root Cause

The root cause is missing bounds checking during PSP chunk or block parsing. Length or size fields inside the PSP file are trusted without verification against the allocated destination buffer. When a manipulated field exceeds the buffer capacity, the parser writes attacker-controlled bytes beyond the allocation boundary, satisfying the classic [CWE-787] out-of-bounds write pattern.

Attack Vector

An attacker crafts a malicious .psp file and delivers it to a victim through phishing, a malicious website, or a shared file location. When the victim opens the file with IrfanView, the parser processes the crafted structure and triggers the out-of-bounds write. No authentication is required, but user interaction is mandatory. The resulting code executes with the current user's privileges, providing an initial foothold for follow-on activity. Refer to the Zero Day Initiative advisory ZDI-24-970 for additional technical details.

Detection Methods for CVE-2024-6818

Indicators of Compromise

Unexpected i_view64.exe or i_view32.exe child processes spawning shells, scripting engines, or rundll32.exe
IrfanView process crashes or Windows Error Reporting (WER) entries referencing PSP file handling
.psp files arriving via email attachments, downloads, or removable media from untrusted sources
Outbound network connections initiated by the IrfanView process shortly after opening an image file

Detection Strategies

Monitor process lineage for IrfanView spawning cmd.exe, powershell.exe, wscript.exe, or other interpreters
Deploy behavioral endpoint identification rules that flag heap corruption exploitation patterns in image viewer processes
Inspect email gateways and web proxies for .psp file transfers, which are uncommon in most environments

Monitoring Recommendations

Enable Windows Defender Exploit Guard and log all exploit protection events for IrfanView
Collect and centralize Sysmon Event IDs 1 (process create), 7 (image load), and 11 (file create) for IrfanView binaries
Alert on IrfanView writing executable files or modifying registry Run keys, which indicates post-exploitation activity

How to Mitigate CVE-2024-6818

Immediate Actions Required

Update IrfanView to a version released after November 2024 that addresses the PSP parsing flaw
Restrict file association for .psp files if PSP support is not required in the environment
Advise users not to open PSP files from untrusted sources including email attachments and unknown websites
Apply application allowlisting to constrain what IrfanView child processes may execute

Patch Information

Refer to the Zero Day Initiative advisory ZDI-24-970 and the official IrfanView website for the latest release addressing this vulnerability. Users should upgrade beyond version 4.66 x64 to a build that incorporates corrected PSP parsing bounds checks.

Workarounds

Remove or disable the PSP format plugin from the IrfanView plugins directory if not needed
Unassociate the .psp extension from IrfanView using Windows Default Apps settings
Run IrfanView within a low-privilege user account or sandboxed container to limit exploitation impact
Block .psp attachments at the email gateway when the format is not required for business operations

bash

# Remove PSP association and plugin (PowerShell, run as administrator)
Remove-Item "C:\Program Files\IrfanView\Plugins\Psp.dll" -Force
cmd /c ftype pspfile=
cmd /c assoc .psp=