Arbitrary Code Execution Vulnerability in IrfanView's PDF Plugin
CVE-2017-15262

7.8HIGH

Key Information:

Vendor

Irfanview
Status
PDF
Irfanview
Vendor
CVE Published:
11 October 2017

What is CVE-2017-15262?

IrfanView version 4.44 (32bit), when used with the PDF plugin version 4.43, is vulnerable to arbitrary code execution. Attackers can exploit this vulnerability by crafting a specially designed PDF file that causes the application to mishandle data, ultimately leading to unauthorized code execution or potential service disruption. The issue stems from improper handling of data from faulting addresses, resulting in unintended control flow within the program.

References

https://github.com/wlinzi/security_advisories/tree/master...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.