Remote Code Execution Vulnerability in IrfanView CADImage Plugin

CVE-2025-7247

What is CVE-2025-7247?

The IrfanView CADImage Plugin contains a vulnerability that affects its ability to properly handle DXF file parsing. Specifically, the flaw arises from inadequate validation of user-supplied data, which may lead to an out-of-bounds read error. This can allow remote attackers, through the use of malicious files or web pages, to execute arbitrary code on the systems operating this plugin. Successful exploitation requires that a user interact with the malicious content, thus enabling the attacker to run code with the permissions of the running process.

References