CVE-2025-7238: IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26084.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Mitigate the vulnerability by preventing untrusted DXF files from being processed by the CADImage Plugin (e.g., configure workflow to block/quarantine DXF inputs) since the flaw is in DXF file parsing and can lead to write past the end of an allocated buffer.
IrfanView CADImage Plugin (DXF parser) DXF file parsing exposure = disabled/quarantined for untrusted files - Compensating control
Because exploitation requires user interaction (visit a malicious page or open a malicious file), restrict users from opening untrusted CADImage Plugin DXF files (e.g., via policies/controls that block or quarantine untrusted attachments) to reduce exposure to the ZDI-CAN-26084 out-of-bounds write that can lead to remote code execution.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7238?
CVE-2025-7238 has a high severity rating due to its potential for remote code execution.
How do I fix CVE-2025-7238?
To fix CVE-2025-7238, update your IrfanView CADImage Plugin to the latest version provided by the vendor.
What systems are affected by CVE-2025-7238?
CVE-2025-7238 affects installations of IrfanView using the CADImage Plugin.
Is user interaction required to exploit CVE-2025-7238?
Yes, user interaction is required for an attacker to exploit CVE-2025-7238.
What type of vulnerability is CVE-2025-7238?
CVE-2025-7238 is classified as an out-of-bounds write vulnerability that can lead to remote code execution.