CVE-2026-107125: XnView Classic FLI File heap-based overflow
A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument startingline causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
XnView Classicto a version that resolves this vulnerability.Fixed in 2.52.6
Event History
Frequently Asked Questions
What does an attacker need to do to exploit this issue?
An attacker needs to induce a user to open or process a crafted FLI file. The attack can be delivered remotely, but user interaction is required.
Which version should be upgraded?
XnView Classic 2.52.5 is identified as affected. Upgrade to version 2.52.6 to address the vulnerability.
What is the impact of successful exploitation?
The vulnerability is a heap-based buffer overflow in the FLI File Parser caused by manipulation of the starting_line argument. The supplied severity vector indicates potential low-impact effects to confidentiality, integrity, and availability.