IrfanView CADImage Plugin Remote Code Execution Vulnerability

CVE-2025-7261

What is CVE-2025-7261?

The IrfanView CADImage Plugin contains a vulnerability in DWG file parsing that may allow remote attackers to execute arbitrary code. This issue arises from inadequate validation of user-supplied data, enabling reads beyond allocated buffers. Successful exploitation requires user interaction, where a victim must visit a malicious web page or open a compromised DWG file. Users should ensure their plugin is updated to mitigate this risk. For detailed information, refer to the advisory ZDI-25-509.

References