CVE-2024-6819: IrfanView PSP File RCE Vulnerability

CVE-2024-6819 Overview

CVE-2024-6819 is an out-of-bounds write vulnerability in IrfanView, a widely deployed Windows image viewer. The flaw exists in the parser that processes Paint Shop Pro (PSP) image files. Attackers can leverage improper validation of user-supplied data to write past the end of an allocated buffer. Successful exploitation results in arbitrary code execution in the context of the current user.

Exploitation requires user interaction. A target must open a malicious PSP file or visit a page that delivers one. The issue was reported through the Zero Day Initiative as ZDI-CAN-23219 and published as advisory ZDI-24-971.

Critical Impact
Opening a crafted PSP file in a vulnerable IrfanView build allows an attacker to execute arbitrary code with the privileges of the logged-on user.

Affected Products

IrfanView 4.66 (x64)
IrfanView installations that load the PSP file format handler
Systems with file associations that route PSP files to IrfanView

Discovery Timeline

2024-11-22 - CVE-2024-6819 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6819

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] triggered while IrfanView parses PSP (Paint Shop Pro) image files. The parser fails to validate specific length or offset fields supplied by the file before using them to compute a write destination. When these attacker-controlled values exceed the size of the allocated buffer, the parser overwrites adjacent heap memory.

An attacker who controls the overwritten memory can steer program execution. Typical strategies include corrupting object pointers, virtual function tables, or heap metadata to redirect control flow. Because IrfanView runs as an unsandboxed desktop application, successful exploitation grants execution at the privilege level of the user who opened the file.

The attack surface is broad. IrfanView is a common default handler for many image formats, and PSP files can be delivered by email, chat, web download, or shared drives. Preview integrations and thumbnail handlers can further reduce the interaction required for exploitation.

Root Cause

The root cause is missing bounds checking on values read from the PSP file structure. The parser trusts field sizes provided in the file header or chunk descriptors and does not verify them against the size of the destination buffer before performing a copy or write operation.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious PSP file and delivers it to a target. When the victim opens the file in IrfanView, or triggers a preview handler that invokes the vulnerable parser, the out-of-bounds write executes. No authentication is required on the target system.

Refer to the Zero Day Initiative Advisory ZDI-24-971 for additional technical context.

Detection Methods for CVE-2024-6819

Indicators of Compromise

Unexpected child processes spawned by i_view64.exe or i_view32.exe, particularly command interpreters such as cmd.exe, powershell.exe, or rundll32.exe
PSP files (.psp, .pspimage) arriving through email, messaging, or web downloads from untrusted sources
Crash dumps or Windows Error Reporting entries referencing IrfanView modules while handling image files

Detection Strategies

Monitor process lineage for IrfanView spawning interactive shells, scripting hosts, or network utilities
Alert on IrfanView processes performing outbound network connections, which is atypical for an image viewer
Inspect file system telemetry for PSP files being opened from user download directories followed by process anomalies

Monitoring Recommendations

Enable command-line and process creation auditing (Windows Event ID 4688 with command line logging, or Sysmon Event ID 1) on endpoints where IrfanView is installed
Forward endpoint telemetry to a centralized analytics platform to correlate image parser crashes with subsequent suspicious activity
Track software inventory to identify hosts still running IrfanView 4.66 or earlier

How to Mitigate CVE-2024-6819

Immediate Actions Required

Upgrade IrfanView to the latest version released after November 2024 that addresses the PSP parsing flaw
Restrict opening PSP files from untrusted sources and block them at email and web gateways where feasible
Remove or disable IrfanView shell integrations and thumbnail providers on systems that do not require them

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-971 for vendor coordination status and the latest patched build information. Users should download updates only from the official IrfanView distribution site.

Workarounds

Remove PSP from the list of file associations handled by IrfanView
Configure gateway and endpoint controls to block .psp and .pspimage attachments from external senders
Run IrfanView under a standard user account and enforce application allow-listing to limit post-exploitation impact

bash

# Configuration example: enumerate IrfanView installations and versions across Windows endpoints
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'IrfanView*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation