Memory Corruption Vulnerability in IrfanView CADImage Plugin Allowing Remote Code Execution
CVE-2025-7301

7.8HIGH

Key Information:

Vendor

Irfanview
Status
Irfanview
Vendor
CVE Published:
21 July 2025

What is CVE-2025-7301?

The IrfanView CADImage Plugin has a vulnerability in its DWG file parsing component that could allow remote attackers to execute arbitrary code. The flaw arises due to insufficient validation of user-supplied data, leading to potential memory corruption. Exploitation requires user interaction, such as visiting a malicious webpage or opening a compromised file. Attackers could leverage this vulnerability to run code in the context of the application, posing significant risks to system integrity and user data.

Affected Version(s)

IrfanView 4.70.0.0

References

https://www.zerodayinitiative.com/advisories/ZDI-25-548/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.