Remote Code Execution Vulnerability in IrfanView CADImage Plugin for DXF Files

CVE-2025-7238

What is CVE-2025-7238?

The IrfanView CADImage Plugin has a vulnerability in its DXF file parsing, which is susceptible to out-of-bounds writes. This occurs due to inadequate validation of user-supplied data, causing the application to write past the allocated buffer. Attackers can exploit this flaw by tricking users into opening a specially crafted DXF file, which allows for arbitrary code execution in the context of the affected system. This poses a significant risk as malicious actors can harness this vulnerability to execute harmful code, leading to potential system compromise.

References