CVE-2025-7312

Executive Summary

CVE-2025-7312 is a critical out-of-bounds read vulnerability in the IrfanView CADImage Plugin when parsing specially crafted DWG files. The flaw allows remote code execution in the context of the current process, requiring user interaction (opening a malicious file or visiting a malicious page). With a CVSS score of 7.8, this vulnerability poses a significant risk to users of IrfanView with the CADImage Plugin installed. No public exploit or patch is currently available, but the technical details from ZDI (ZDI-CAN-26398) indicate the issue stems from improper validation of user-supplied data leading to a read past the end of an allocated buffer.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects a standalone Windows desktop application (IrfanView) and its plugin. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires user to open a malicious file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Exploitation can lead to full compromise of the user's system, but requires user interaction.

Deep Dive & Mechanics

The vulnerability resides in the CADImage Plugin's DWG file parser. When processing a malicious DWG file, the plugin fails to properly validate the length of user-supplied data before reading from a buffer. This results in an out-of-bounds read, which can be leveraged by an attacker to read sensitive memory contents or, more critically, to achieve code execution by corrupting adjacent memory structures.

Root Cause: Lack of proper bounds checking on a buffer read operation during DWG file parsing.

Attack Vector: Remote attacker delivers a malicious DWG file via email, download, or web page. The victim must open the file with IrfanView (or the plugin) for exploitation to occur.

Impact: Successful exploitation allows arbitrary code execution in the context of the IrfanView process, potentially leading to full system compromise.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is in the CADImage Plugin's DWG parsing routine. A hypothetical fix would involve adding bounds checking before buffer reads:

Vulnerable (pseudocode):

void parse_dwg_data(char *buffer, size_t size) {
    // No bounds check
    int length = *(int*)buffer;
    char *data = buffer + 4;
    // Out-of-bounds read if length > size - 4
    process_data(data, length);
}

Patched (pseudocode):

void parse_dwg_data(char *buffer, size_t size) {
    if (size < 4) return;
    int length = *(int*)buffer;
    if (length > size - 4) return; // Bounds check
    char *data = buffer + 4;
    process_data(data, length);
}

Exploitation & Lab Setup

Red Team

No public exploit code is available. However, a proof-of-concept can be developed by crafting a DWG file with a manipulated length field that exceeds the actual buffer size. The following steps outline a lab setup:

1. Environment: Windows 10/11 with IrfanView and CADImage Plugin installed.
2. Tooling: Python with struct module to craft a malicious DWG file.
3. Exploit Concept:
   • Create a DWG file with a header containing a large length value.
   • The plugin will attempt to read beyond the allocated buffer.
   • Use a debugger (e.g., x64dbg) to observe the crash and potentially control execution.

Example Python script to generate a malformed DWG file:

import struct

def create_malicious_dwg(filename):
    # Minimal DWG header with oversized length
    header = b'\x41\x43\x31\x30'  # AC10 signature
    length = 0xFFFFFFFF  # Large length to trigger OOB read
    payload = struct.pack('<I', length) + b'A' * 100
    with open(filename, 'wb') as f:
        f.write(header + payload)

create_malicious_dwg('malicious.dwg')

Blue Team

• Detection: Monitor for crashes of i_view32.exe or CADImage.dll when processing DWG files.
• Prevention: Disable the CADImage Plugin or restrict execution of IrfanView in sandboxed environments.
• Hunting: Search for unusual DWG files with abnormal header sizes or repeated patterns.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available yet; generate upon discovery)
• Process Anomalies: i_view32.exe crashing with access violation reading memory at address 0x????????
• Network: No network indicators; exploitation is local.
• Registry: No known registry changes.
• File Artifacts: Malicious DWG files with oversized length fields in the header.

Detection Engineering

YARA Rule

rule CVE_2025_7312_CADImage_OOB_Read {
    meta:
        description = "Detects malicious DWG files exploiting CVE-2025-7312"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "ZDI-CAN-26398"
    strings:
        $dwg_header = { 41 43 31 30 } // AC10 header
        $large_length = { FF FF FF FF } // Potential oversized length
    condition:
        $dwg_header at 0 and $large_length at 4
}

Sigma Rule

title: CVE-2025-7312 IrfanView CADImage Plugin OOB Read
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects crashes or access violations in IrfanView when processing DWG files
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: 'i_view32.exe'
        CommandLine|contains: '.dwg'
    condition: selection
falsepositives:
    - Legitimate DWG files with large headers
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7312 IrfanView CADImage Plugin DWG OOB Read"; flow:to_server,established; content:"|41 43 31 30|"; offset:0; depth:4; content:"|FF FF FF FF|"; offset:4; depth:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or uninstall the CADImage Plugin until a patch is released.
• User Awareness: Educate users not to open DWG files from untrusted sources.
• Application Control: Use AppLocker or similar to restrict IrfanView execution.
• Sandboxing: Run IrfanView in a sandboxed environment (e.g., Windows Sandbox, Sandboxie).
• Monitoring: Enable crash dumps and monitor for i_view32.exe crashes.
• Vendor Contact: Monitor IrfanView official site for updates.

Valters IT
DevSecOps & Cyber Threat Intelligence