Memory Corruption Issue in IrfanView CADImage Plugin Allows Code Execution
CVE-2025-7305

7.8HIGH

Key Information:

Vendor

Irfanview
Status
Irfanview
Vendor
CVE Published:
21 July 2025

What is CVE-2025-7305?

The vulnerability identified in the IrfanView CADImage Plugin relates to improper validation during the parsing of DWG files, which can lead to memory corruption. This flaw permits remote attackers to execute arbitrary code on systems using the affected plugin. To exploit this vulnerability, the user must be tricked into visiting a malicious webpage or opening a crafted DWG file. Addressing this vulnerability is crucial for maintaining the integrity and security of systems running IrfanView and its associated plugins.

Affected Version(s)

IrfanView 4.70.0.0

References

https://www.zerodayinitiative.com/advisories/ZDI-25-552/
x_research-advisory

CVSS V3.0

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-7305 : Memory Corruption Issue in IrfanView CADImage Plugin Allows Code Execution