Remote Code Execution Vulnerability in IrfanView WSQ File Parsing
CVE-2024-6811

7.8HIGH

Key Information:

Vendor

Irfanview
Status
Irfanview
Wsq
Vendor
CVE Published:
21 August 2024

What is CVE-2024-6811?

The vulnerability within IrfanView's WSQ file parsing mechanism presents a significant risk, allowing attackers to execute arbitrary code on systems where the software is installed. This issue arises from improper validation of user-supplied data during the processing of WSQ files, which may lead to an out-of-bounds write. To exploit this vulnerability, an attacker must entice a user to visit a malicious page or open a specially crafted WSQ file. The execution of arbitrary code could occur within the context of the current user's privileges, potentially compromising the integrity and confidentiality of the affected system.

References

https://www.zerodayinitiative.com/advisories/ZDI-24-903/

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.