CVE-2025-7233: IrfanView CADImage Plugin DWG Parsing Flaw

CVE-2025-7233 Overview

CVE-2025-7233 is an out-of-bounds read vulnerability in the IrfanView CADImage plugin developed by CadSoftTools. The flaw resides in the plugin's parsing of DWG (AutoCAD drawing) files and allows a remote attacker to disclose sensitive memory contents when a user opens a crafted file. Exploitation requires user interaction: the victim must open the malicious DWG file or visit a page that delivers it. The Zero Day Initiative tracked this issue as ZDI-CAN-26072 and published advisory ZDI-25-494. While the direct impact is information disclosure, attackers can chain the primitive with other weaknesses to achieve arbitrary code execution in the context of the IrfanView process.

Critical Impact
Attackers can read memory beyond an allocated buffer during DWG parsing, leaking sensitive process data that can be chained with other vulnerabilities to execute arbitrary code.

Affected Products

IrfanView (x86 and x64 builds) with the CADImage plugin installed
CadSoftTools CADImage plugin for IrfanView (x86)
CadSoftTools CADImage plugin for IrfanView (x64)

Discovery Timeline

2025-07-21 - CVE-2025-7233 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7233

Vulnerability Analysis

The vulnerability is classified under CWE-125: Out-of-bounds Read. It occurs inside the CADImage plugin's DWG file parser, which fails to properly validate user-supplied data embedded in the file structure. When the parser trusts an attacker-controlled length, offset, or index value, it issues a read past the end of a heap-allocated buffer. The disclosed bytes typically include adjacent heap metadata, pointers, or residual data from prior allocations. Because IrfanView loads the plugin into its own process space, any leaked data belongs to the user running the application. The read primitive on its own does not corrupt memory, but it provides the kind of address or canary leak needed to bypass mitigations such as ASLR when combined with a separate memory-corruption bug.

Root Cause

The root cause is insufficient bounds checking on fields parsed from the DWG container. The plugin dereferences buffer offsets derived from untrusted input without confirming they fall within the allocation boundary. CWE-125 enumerates this exact class of defect.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted DWG file through email, a download link, or a web page that triggers IrfanView as a handler. When the victim opens the file, the CADImage plugin parses it and reaches the out-of-bounds read. No elevated privileges or authentication are required on the target host.

No verified public proof-of-concept code is available. Refer to the Zero Day Initiative Advisory ZDI-25-494 for additional technical context.

Detection Methods for CVE-2025-7233

Indicators of Compromise

Unexpected .dwg files arriving via email attachments, chat applications, or browser downloads and subsequently opened by i_view32.exe or i_view64.exe.
IrfanView process crashes, hangs, or access-violation events immediately after loading a DWG file through the CADImage plugin.
Loading of CADImage.dll by IrfanView followed by anomalous child process creation or outbound network connections.

Detection Strategies

Build endpoint rules that correlate IrfanView process execution with DWG file reads from user-writable paths such as %TEMP%, Downloads, or email cache directories.
Alert on IrfanView spawning command interpreters (cmd.exe, powershell.exe) or script hosts, which would indicate successful chaining to code execution.
Inspect mail and web gateways for DWG attachments originating from untrusted senders and apply sandbox detonation where possible.

Monitoring Recommendations

Enable Windows Error Reporting and crash telemetry for IrfanView to surface parser faults that may indicate exploitation attempts.
Collect module load events for CADImage.dll and track hosts where the plugin is installed to scope exposure.
Monitor Sysmon Event ID 11 (file create) for DWG files written to user profile directories, paired with Event ID 1 process creation for IrfanView.

How to Mitigate CVE-2025-7233

Immediate Actions Required

Inventory endpoints with IrfanView and the CADImage plugin installed, prioritizing workstations used by engineering, architecture, or design teams.
Remove or disable the CADImage plugin on systems where DWG viewing is not required until a patched version is confirmed deployed.
Instruct users not to open DWG files received from untrusted sources and block DWG attachments at the email gateway where feasible.

Patch Information

At the time of publication, no vendor patch URL was listed in the NVD entry. Consult the Zero Day Initiative Advisory ZDI-25-494 and the CadSoftTools and IrfanView vendor sites for the latest CADImage plugin release that remediates the DWG parsing flaw. Apply the updated plugin to all affected IrfanView installations.

Workarounds

Uninstall the CADImage plugin from IrfanView on hosts that do not require CAD file viewing.
Change the default file association for .dwg files to a trusted CAD application that is not affected by this issue.
Enforce application control policies that prevent IrfanView from executing on systems that do not need it, reducing the attack surface.

bash

# Example: remove the CADImage plugin DLL from an IrfanView installation
REM Run from an elevated command prompt
del "C:\Program Files\IrfanView\Plugins\CADImage.dll"
del "C:\Program Files (x86)\IrfanView\Plugins\CADImage.dll"