CVE-2025-7323

Executive Summary

CVE-2025-7323 is a critical memory corruption vulnerability in the IrfanView CADImage Plugin when parsing specially crafted DWG files. The flaw stems from improper validation of user-supplied data, leading to a memory corruption condition that can be leveraged for remote code execution (RCE) in the context of the current process. User interaction is required—the victim must open a malicious DWG file or visit a malicious page. With a CVSS score of 7.8, this vulnerability poses a significant risk to systems using IrfanView with the CADImage Plugin, especially in environments where untrusted DWG files are processed. No public exploit or patch is currently available, but the technical details are sufficient for developing detection and mitigation strategies.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It affects a standalone Windows desktop application (IrfanView) and its plugin. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector: Local (requires user to open a file)
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. Exploitation could lead to full system compromise under the user’s privileges. The lack of a patch increases the risk.

Deep Dive & Mechanics

The vulnerability resides in the CADImage Plugin’s DWG file parser. DWG files contain binary data structures for CAD drawings. The plugin fails to validate the size or boundaries of user-supplied data when reading specific fields, leading to a buffer overflow or other memory corruption. An attacker can craft a DWG file with oversized or malformed data in a particular field (e.g., a block name, layer name, or coordinate value). When the plugin processes this field, it writes beyond the allocated buffer, corrupting adjacent memory. This can be exploited to overwrite function pointers or return addresses, achieving arbitrary code execution.

The specific flaw (ZDI-CAN-26428) was reported via the Zero Day Initiative. The plugin runs within the IrfanView process, so successful exploitation grants the attacker the same privileges as the user running IrfanView.

Vulnerable vs. Patched Code

Since no patch is available, a direct code comparison is not possible. However, the vulnerable code likely resembles:

// Vulnerable: no bounds check
void parse_dwg_field(char *buffer, int size) {
    char field[256];
    memcpy(field, buffer, size); // size can be > 256
}

A patched version would include validation:

// Patched: bounds check
void parse_dwg_field(char *buffer, int size) {
    char field[256];
    if (size > 256) {
        // handle error
        return;
    }
    memcpy(field, buffer, size);
}

Exploitation & Lab Setup

Red Team

Objective: Achieve RCE via a malicious DWG file.

Setup:

1. Install IrfanView with CADImage Plugin on a Windows VM.
2. Use a fuzzer (e.g., boofuzz) to identify the exact offset and field causing corruption.
3. Craft a DWG file with a malicious payload in the vulnerable field (e.g., a long block name).
4. Use a debugger (x64dbg) to find the overwritten return address or SEH handler.
5. Generate shellcode (e.g., msfvenom) for a reverse shell.
6. Embed the shellcode in the DWG file and deliver it to the victim (e.g., via email or web download).

Example payload structure:

[DWG header]
[Vulnerable field: 256 bytes of padding + 8 bytes overwrite + shellcode]

Note: No public exploit code is available; this is a theoretical approach.

Blue Team

Detection:

• Monitor for IrfanView crashes (Event ID 1000 in Windows Application logs).
• Use file scanning to detect anomalous DWG files (e.g., oversized fields).
• Deploy the YARA and Sigma rules below.

Mitigation:

• Block DWG files from untrusted sources.
• Use application whitelisting to prevent IrfanView from executing.
• Run IrfanView in a sandbox or with reduced privileges.

Indicators of Compromise (IOCs)

• File Hashes: (No known samples; placeholder)
  • malicious.dwg SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Process Behavior:
  • i_view32.exe (IrfanView) crashes with exception code 0xc0000005 (access violation).
  • Unusual child processes spawned from i_view32.exe (e.g., cmd.exe, powershell.exe).
• Network:
  • Outbound connections from i_view32.exe to unknown IPs (if shellcode connects back).
• Registry:
  • Modifications to HKCU\Software\IrfanView (unlikely but possible).

Detection Engineering

YARA Rule

rule CVE_2025_7323_DWG_Memory_Corruption {
    meta:
        description = "Detects malicious DWG files targeting CVE-2025-7323"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-7323"
    strings:
        $dwg_header = { 41 43 31 30 } // "AC10" DWG header
        $long_field = /.{512,}/ // field longer than 512 bytes
    condition:
        $dwg_header at 0 and #long_field > 0
}

Sigma Rule

title: IrfanView CADImage Plugin Crash
id: 7b8c9d0e-1f2a-3b4c-5d6e-7f8a9b0c1d2e
status: experimental
description: Detects IrfanView crashes indicative of CVE-2025-7323 exploitation
author: Valters IT
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        ApplicationName: 'i_view32.exe'
        ExceptionCode: '0xc0000005'
    condition: selection
falsepositives:
    - Legitimate crashes due to other bugs
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-7323 Potential Outbound from IrfanView"; flow:to_server; content:"|00 00 00 00|"; depth:4; offset:0; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable or uninstall the CADImage Plugin until a patch is released.
• Workaround: Use an alternative image viewer for DWG files (e.g., LibreCAD, AutoCAD Viewer).
• Long-term: Monitor the vendor’s website for updates. Apply the patch when available.
• Detection: Deploy the YARA and Sigma rules above. Enable Windows Application logging.
• User Training: Educate users not to open DWG files from untrusted sources.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert