IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26202.
The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26202.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Cadsofttools |
|
| Irfanview |
|
Configuration 1 [-]
| AND |
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-22216 | IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26202. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://www.zerodayinitiative.com/advisories/ZDI-25-519/ |
|
History
Fri, 25 Jul 2025 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cadsofttools
Cadsofttools cadimage Irfanview Irfanview irfanview |
|
| CPEs | cpe:2.3:a:cadsofttools:cadimage:*:*:*:*:*:irfanview:x64:* cpe:2.3:a:cadsofttools:cadimage:*:*:*:*:*:irfanview:x86:* cpe:2.3:a:irfanview:irfanview:*:*:*:*:*:*:x64:* cpe:2.3:a:irfanview:irfanview:*:*:*:*:*:*:x86:* |
|
| Vendors & Products |
Cadsofttools
Cadsofttools cadimage Irfanview Irfanview irfanview |
Tue, 22 Jul 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 21 Jul 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26202. | |
| Title | IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability | |
| Weaknesses | CWE-125 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: zdi
Published:
Updated: 2025-07-22T13:34:05.765Z
Reserved: 2025-07-07T15:06:40.758Z
Link: CVE-2025-7273
Vulnrichment
Updated: 2025-07-22T13:34:02.715Z
NVD
Status : Analyzed
Published: 2025-07-21T20:15:49.137
Modified: 2025-07-25T14:28:28.330
Link: CVE-2025-7273
Redhat
No data.
OpenCVE Enrichment
No data.