Description
A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.
Published: 2026-10-07
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Upgrade
AI Analysis

Impact

The flaw lies in XnView Classic's FLI file parser, where an attacker can manipulate the starting_line argument to trigger a heap‑based buffer overflow. If an attacker succeeds, the overflow could allow arbitrary code execution or other malicious actions against the host system.

Affected Systems

XnView Classic 2.52.5 is affected. The vendor recommends upgrading to version 2.52.6 to remove the vulnerability. No other versions are listed as impacted in the advisory.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Remote exploitation is possible, suggesting the attack vector may involve delivery of a crafted FLI file to the application from an external source. While not immediately critical, the risk of code execution warrants timely remediation.

Generated by OpenCVE AI on October 7, 2026 at 15:25 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade XnView Classic to version 2.52.6 or later.
  • If an upgrade is not feasible, avoid opening or processing FLI files from untrusted or unknown sources.
  • Restrict the application’s file access permissions and monitor for abnormal memory usage or crashes that could indicate exploitation.

Generated by OpenCVE AI on October 7, 2026 at 15:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 07 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 07 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.
Title XnView Classic FLI File heap-based overflow
First Time appeared Xnview
Xnview classic
Weaknesses CWE-119
CWE-122
CPEs cpe:2.3:a:xnview:classic:*:*:*:*:*:*:*:*
Vendors & Products Xnview
Xnview classic
References
Metrics cvssV2_0

{'score': 7.5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 6.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Xnview Classic
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-07T17:20:44.931Z

Reserved: 2026-10-07T07:48:18.231Z

Link: CVE-2026-107125

cve-icon Vulnrichment

Updated: 2026-10-07T17:20:31.351Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-07T15:17:18.440

Modified: 2026-10-07T18:17:17.677

Link: CVE-2026-107125

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T16:45:08Z

Weaknesses
  • CWE-119

    Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-122

    Heap-based Buffer Overflow