CVE-2025-7319

Executive Summary

CVE-2025-7319 is a critical out-of-bounds read vulnerability in the IrfanView CADImage Plugin when parsing specially crafted DWG files. The flaw allows remote code execution in the context of the current process, requiring user interaction (opening a malicious file or visiting a malicious page). With a CVSS score of 7.8, this vulnerability poses a significant risk to users of IrfanView with the CADImage Plugin installed. No public exploit or patch is currently available, but the technical details from ZDI (ZDI-CAN-26413) indicate a classic buffer over-read due to insufficient validation of user-supplied data.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects a standalone Windows application plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (AV:L) – requires user to open a file.
• Attack Complexity (AC): Low (AC:L) – no special conditions.
• Privileges Required (PR): None (PR:N).
• User Interaction (UI): Required (UI:R) – victim must open the file.
• Scope (S): Unchanged (S:U).
• Confidentiality (C): High (C:H).
• Integrity (I): High (I:H).
• Availability (A): High (A:H).

Threat Level: Critical. Exploitation can lead to full compromise of the user's system.

Deep Dive & Mechanics

The vulnerability resides in the CADImage Plugin's DWG file parser. When parsing a DWG file, the plugin fails to properly validate the length of user-supplied data before reading from an allocated buffer. An attacker can craft a DWG file with a specially malformed section that causes the parser to read beyond the buffer boundary. This out-of-bounds read can be leveraged to leak sensitive memory or, more critically, to achieve code execution by corrupting adjacent memory structures.

The root cause is a missing bounds check in the parsing logic. The plugin reads data from the file into a fixed-size buffer but does not verify that the expected data length does not exceed the buffer size. By providing a DWG file with an oversized field, the attacker triggers a read past the end of the buffer, potentially accessing attacker-controlled data that can be used to hijack execution flow.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code path is unknown. However, based on the CWE-125 description, the vulnerable code likely resembles:

// Vulnerable pseudo-code
void parse_dwg_field(char *buffer, int buffer_size, int field_length) {
    // No check if field_length > buffer_size
    for (int i = 0; i < field_length; i++) {
        process_byte(buffer[i]); // Out-of-bounds read if field_length > buffer_size
    }
}

A patched version would include a bounds check:

// Patched pseudo-code
void parse_dwg_field(char *buffer, int buffer_size, int field_length) {
    if (field_length > buffer_size) {
        // Handle error or truncate
        field_length = buffer_size;
    }
    for (int i = 0; i < field_length; i++) {
        process_byte(buffer[i]);
    }
}

Exploitation & Lab Setup

Red Team

Objective: Achieve remote code execution on a target system running IrfanView with CADImage Plugin.

Lab Setup:

• Windows 10/11 VM with IrfanView 4.67 (or latest) and CADImage Plugin installed.
• Python 3.x for crafting the malicious DWG file.
• Debugger (x64dbg) for analysis.

Steps:

1. Craft Malicious DWG: Use a hex editor or Python script to create a DWG file with an oversized field in a section parsed by the plugin.
2. Deliver Payload: Send the file via email or host on a malicious website.
3. Trigger Exploit: Victim opens the file in IrfanView.
4. Achieve Code Execution: The out-of-bounds read corrupts a function pointer or return address, redirecting execution to shellcode.

Example Python script to generate a malformed DWG:

import struct

def create_malicious_dwg():
    # Minimal DWG header (simplified)
    dwg = b'\x41\x43\x31\x30'  # AC10 magic
    dwg += struct.pack('<I', 0xFFFFFFFF)  # Oversized field length
    dwg += b'A' * 1000  # Padding to trigger OOB read
    with open('malicious.dwg', 'wb') as f:
        f.write(dwg)

create_malicious_dwg()

Blue Team

Detection:

• Monitor for IrfanView crashes (Event ID 1000 in Windows Application logs).
• Use file reputation services to block unknown DWG files.
• Deploy endpoint detection rules for out-of-bounds read patterns.

Hunting:

• Search for DWG files with anomalous header fields (e.g., field length > 1000 bytes).
• Analyze memory dumps for signs of heap corruption.

Indicators of Compromise (IOCs)

• File Hashes: (No known samples yet)
• Network: Connections to attacker-controlled IPs after exploitation.
• Process: IrfanView.exe spawning cmd.exe or powershell.exe.
• Registry: Unusual entries in HKCU\Software\IrfanView.
• File System: Temporary files in %TEMP% with random names.

Detection Engineering

YARA Rule

rule CVE_2025_7319_DWG_OOB {
    meta:
        description = "Detects malformed DWG files exploiting CVE-2025-7319"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-7319"
    strings:
        $magic = "AC10"  // DWG magic bytes
        $oob_pattern = { FF FF FF FF }  // Oversized field length
    condition:
        $magic at 0 and $oob_pattern
}

Sigma Rule

title: CVE-2025-7319 IrfanView CADImage Plugin OOB Read
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2025-7319 via process crash or anomalous behavior
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\IrfanView.exe'
        CommandLine|contains: 'dwg'
    condition: selection
falsepositives:
    - Legitimate DWG file parsing
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7319 IrfanView DWG OOB Exploit"; flow:to_server,established; content:"|41 43 31 30|"; offset:0; depth:4; content:"|FF FF FF FF|"; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or uninstall the CADImage Plugin until a patch is released.
• User Awareness: Train users not to open DWG files from untrusted sources.
• Application Control: Use AppLocker or WDAC to block IrfanView from executing untrusted scripts.
• Network: Block inbound/outbound connections from IrfanView if not required.
• Monitor: Deploy the provided detection rules and monitor for crashes.

Valters IT
Securing Digital Frontiers