CVE-2024-9259: IrfanView SID File Parsing RCE Vulnerability

CVE-2024-9259 Overview

CVE-2024-9259 is an out-of-bounds write vulnerability [CWE-787] in IrfanView, a widely deployed Windows image viewer. The flaw resides in the parser that handles SID files and stems from missing validation of user-supplied data. An attacker who convinces a user to open a crafted SID file can write past the end of an allocated buffer and execute arbitrary code in the context of the current process. The Zero Day Initiative tracked this issue as ZDI-CAN-23278 and published advisory ZDI-24-1372.

Critical Impact
Successful exploitation gives an attacker arbitrary code execution with the privileges of the user running IrfanView, enabling malware installation, credential theft, or lateral movement.

Affected Products

IrfanView 4.66 (x64)
IrfanView installations processing SID image files
Windows systems with IrfanView configured as default image handler

Discovery Timeline

2024-11-22 - CVE-2024-9259 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9259

Vulnerability Analysis

The vulnerability is an out-of-bounds write triggered during parsing of SID image files. IrfanView reads attacker-controlled fields from the SID container and uses them to compute buffer offsets or copy lengths without proper bounds validation. When a crafted file supplies values outside the expected range, the parser writes attacker-supplied bytes past the end of a heap-allocated buffer. This memory corruption can overwrite adjacent objects, function pointers, or heap metadata, giving an attacker a reliable primitive for code execution.

Exploitation requires user interaction. The victim must open a malicious SID file or visit a page that delivers one through the file handler. Because IrfanView typically runs in the interactive user session, code executes with that user's privileges and full access to their profile.

Root Cause

The root cause is missing validation of length or offset fields inside the SID file format before the parser writes to an allocated buffer. The bug is characteristic of legacy C/C++ image parsers that trust file-supplied sizes.

Attack Vector

Delivery is local through file open, but the file can be staged through email attachments, web downloads, USB media, or drive-by pages that invoke the registered file handler. No authentication or elevated privileges are required, only user interaction.

A public exploit is not available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are documented in the Zero Day Initiative Advisory ZDI-24-1372.

Detection Methods for CVE-2024-9259

Indicators of Compromise

Unexpected crashes of i_view64.exe or i_view32.exe when opening SID files, often indicating exploitation attempts or fuzzing.
SID files delivered from untrusted sources such as email attachments, external drives, or web downloads.
Child processes spawned by IrfanView that are not typical image-viewer activity, such as cmd.exe, powershell.exe, or rundll32.exe.

Detection Strategies

Hunt for IrfanView processes that write executable files, load unsigned DLLs, or make outbound network connections shortly after opening an image.
Correlate Windows Error Reporting or crash dumps referencing IrfanView modules with recent file open events on .sid extensions.
Alert on file-write operations targeting .sid files in user download directories followed by execution of IrfanView.

Monitoring Recommendations

Enable process creation logging (Sysmon Event ID 1) and image load logging (Event ID 7) for IrfanView binaries.
Track file registry changes that associate .sid and other uncommon image formats with IrfanView on managed endpoints.
Forward endpoint telemetry to a central data lake and alert on anomalous IrfanView behavior over a rolling baseline.

How to Mitigate CVE-2024-9259

Immediate Actions Required

Inventory all endpoints running IrfanView 4.66 or earlier and prioritize patching workstations that handle files from external sources.
Update IrfanView to the latest version available from the vendor, which addresses the SID parsing flaw described in ZDI-24-1372.
Restrict SID file execution by removing the file association or blocking .sid attachments at the email gateway until patching is complete.

Patch Information

Refer to the Zero Day Initiative Advisory ZDI-24-1372 for coordinated disclosure details and follow the IrfanView vendor site for the fixed release. Apply the vendor-supplied update to all affected installations and confirm the version through Help > About after upgrade.

Workarounds

Do not open SID files received from untrusted sources; treat unsolicited image attachments as suspicious.
Remove the .sid file association from IrfanView or uninstall IrfanView on systems that do not require it.
Run IrfanView under a standard user account with application allowlisting to limit the impact of successful exploitation.

bash

# Remove .sid file association on Windows (run as administrator)
assoc .sid=
ftype IrfanView.SID=