Remote Code Execution Vulnerability in IrfanView CADImage Plugin
CVE-2025-7271

7.8HIGH

Key Information:

Vendor

Irfanview
Status
Irfanview
Vendor
CVE Published:
21 July 2025

What is CVE-2025-7271?

The IrfanView CADImage Plugin contains a vulnerability in the parsing of DXF files, which permits remote code execution due to improper validation of user-supplied data. Attackers can exploit this flaw by enticing users to either visit a malicious page or open a compromised DXF file. Exploitation leads to memory corruption, allowing code execution within the context of the affected process. This vulnerability necessitates user interaction, making awareness crucial for all users of the plugin.

Affected Version(s)

IrfanView 4.70.0.0

References

https://www.zerodayinitiative.com/advisories/ZDI-25-520/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-7271 : Remote Code Execution Vulnerability in IrfanView CADImage Plugin