Arbitrary Code Execution Vulnerability in IrfanView with FPX Plugin
CVE-2017-9879

7.8HIGH

Key Information:

Vendor

Irfanview
Status
Irfanview
Fpx
Vendor
CVE Published:
5 July 2017

What is CVE-2017-9879?

The vulnerability in IrfanView version 4.44 (32bit), particularly with the FPX Plugin 4.46, permits attackers to execute arbitrary code or create a denial of service. This is achieved by exploiting crafted .fpx files, where improper handling of data from the Faulting Address allows attackers to control subsequent Write Addresses. This can lead to unauthorized actions within the application, posing significant security risks to users.

References

https://github.com/wlinzi/security_advisories/tree/master...
x_refsource_MISC
http://www.irfanview.com/plugins.htm
x_refsource_CONFIRM

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.