CVE-2026-121517: IrfanView TIFF Wang Annotation heap-based overflow
A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".
Event History
Frequently Asked Questions
Are standard IrfanView installations affected?
The vendor states that the TIF-Annotations option is disabled by default, so normal users are not affected unless that option has been enabled.
What does exploitation require?
An attacker must induce user interaction and manipulate content handled by the TIFF Wang Annotation Handler. The attack can be delivered remotely, but it has high complexity and is described as difficult to exploit.
Is exploit code available?
Yes. A public proof of concept is indicated, and the vulnerability information states that the exploit may be used.
What can be done before a patch is applied?
Keep the TIF-Annotations option disabled and avoid opening untrusted TIFF files that may invoke the TIFF Wang Annotation Handler. Applying the vendor patch is recommended.