CVE-2024-9767: IrfanView SID File Parsing RCE Vulnerability

CVE-2024-9767 is a remote code execution vulnerability in IrfanView's SID file parser caused by out-of-bounds read errors. Attackers can exploit this flaw to execute arbitrary code when users open malicious files. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2024-9767 Overview

CVE-2024-9767 is an out-of-bounds read vulnerability in IrfanView that allows attackers to execute arbitrary code on affected installations. The flaw resides in the parser for SID image files and stems from insufficient validation of user-supplied data. An attacker who convinces a user to open a crafted SID file or visit a malicious page hosting one can read past the end of an allocated buffer and execute code in the context of the current process. The issue was reported through the Zero Day Initiative as ZDI-CAN-23277 and published as ZDI-24-1371.

Critical Impact
Successful exploitation grants arbitrary code execution in the context of the user running IrfanView, enabling full compromise of the user's data and session.

Affected Products

IrfanView 4.66 (x64)
IrfanView installations processing SID image files
Environments where IrfanView is registered as a default handler for image formats

Discovery Timeline

2024-11-22 - CVE-2024-9767 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9767

Vulnerability Analysis

The vulnerability is an out-of-bounds read [CWE-125] triggered during parsing of SID (Static Image Data) files by IrfanView. IrfanView reads structured fields from the SID container to determine offsets and buffer sizes used during decoding. When these attacker-controlled values are not validated against the actual buffer bounds, the parser reads memory beyond the end of the allocated buffer.

Because the read occurs in the address space of the IrfanView process, an attacker can influence adjacent memory contents to steer execution flow. The Zero Day Initiative advisory characterizes the outcome as arbitrary code execution in the context of the current process, indicating that the out-of-bounds read is leveraged to reach a control-flow primitive rather than only leak data. Exploitation requires local file handling by the target user, but delivery via web download, email attachment, or shared drive is straightforward.

Root Cause

The root cause is the absence of proper validation of user-supplied length or offset fields inside the SID file structure. The parser trusts attacker-controlled metadata and reads past the end of an allocated buffer during file processing.

Attack Vector

Exploitation requires user interaction. The victim must open a malicious SID file with IrfanView or visit a page that causes such a file to be opened by the registered handler. No elevated privileges are required, and code executes with the same rights as the interactive user.

No verified public proof-of-concept code is available. See the Zero Day Initiative advisory ZDI-24-1371 for the vendor-coordinated technical description.

Detection Methods for CVE-2024-9767

Indicators of Compromise

Unexpected .sid files delivered through email, browser downloads, or removable media to hosts running IrfanView.
Crashes or Windows Error Reporting entries referencing the IrfanView process (i_view64.exe) shortly after opening an image file.
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by IrfanView.

Detection Strategies

Alert on IrfanView spawning shell, scripting, or LOLBin child processes, which is not expected behavior for an image viewer.
Hunt for SID file writes to user-writable directories followed by IrfanView execution referencing that file path.
Monitor for outbound network connections initiated by the IrfanView process, which typically does not require network egress.

Monitoring Recommendations

Collect EDR process, file, and module-load telemetry for i_view32.exe and i_view64.exe across managed endpoints.
Baseline the file types normally opened by IrfanView in your environment and flag anomalies such as SID files from untrusted sources.
Correlate email gateway and web proxy logs with endpoint file-open events to trace the delivery path of suspicious image files.

How to Mitigate CVE-2024-9767

Immediate Actions Required

Inventory endpoints with IrfanView installed and identify systems running version 4.66 or earlier.
Update IrfanView to the latest version released after the ZDI advisory publication.
Restrict or block delivery of .sid attachments at email and web gateways until patching is confirmed.

Patch Information

Refer to the Zero Day Initiative advisory ZDI-24-1371 and the IrfanView download page for the fixed release. Deploy the updated build across all endpoints and remove legacy installers from software distribution shares.

Workarounds

Remove IrfanView as the default handler for SID files and any format that maps to the vulnerable parser.
Apply application allowlisting or Attack Surface Reduction rules to prevent IrfanView from launching child processes.
Run IrfanView under a standard user account and isolate it in an application sandbox where feasible.

bash

# Windows: remove file association for SID files handled by IrfanView
cmd /c "assoc .sid="
cmd /c "ftype i_view64="

# PowerShell: inventory installed IrfanView versions across endpoints
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -like 'IrfanView*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation