CVE-2017-15767 in IrfanView
Summary
by MITRE
IrfanView 4.50 - 64bit with CADImage plugin version 12.0.0.5 allows attackers to execute arbitrary code or cause a denial of service via a crafted .dwg file, related to a "User Mode Write AV near NULL starting at CADIMAGE+0x00000000003d5b52."
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/08/2026
The vulnerability identified as CVE-2017-15767 affects IrfanView version 4.50 64-bit when used with the CADImage plugin version 12.0.0.5, representing a critical security flaw that enables remote code execution or denial of service attacks through maliciously crafted .dwg files. This vulnerability manifests as a user mode write access violation occurring near NULL memory address within the CADIMAGE module, specifically at offset 0x00000000003d5b52, indicating a severe memory corruption issue that can be exploited by attackers to gain unauthorized system access or disrupt normal operations.
The technical flaw stems from insufficient input validation and memory management within the CADImage plugin's handling of AutoCAD Drawing (dwg) files. When IrfanView processes a maliciously crafted .dwg file through the CADImage plugin, the application fails to properly validate the file structure and content, leading to a buffer overflow or memory corruption condition that results in the access violation. This type of vulnerability falls under CWE-121, which describes stack-based buffer overflow conditions, and also relates to CWE-787, representing out-of-bounds write operations that can occur when the application attempts to write data beyond allocated memory boundaries. The specific nature of the issue indicates that the application is attempting to write to a memory location near NULL, which typically suggests that a pointer has been corrupted or improperly initialized during the parsing process.
The operational impact of this vulnerability is significant as it allows attackers to execute arbitrary code on vulnerable systems with the privileges of the user running IrfanView, potentially leading to complete system compromise. The vulnerability can be exploited remotely through various attack vectors including email attachments, web downloads, or file sharing platforms where users might inadvertently open malicious .dwg files. The denial of service aspect of this vulnerability means that even if code execution cannot be achieved, attackers can still cause the application to crash or become unresponsive, effectively disrupting legitimate user operations and potentially enabling persistent denial of service attacks against targeted systems. This vulnerability is particularly dangerous in enterprise environments where users may open files from untrusted sources or where the application is used in automated processing workflows.
Mitigation strategies for CVE-2017-15767 should prioritize immediate patching of the CADImage plugin to version 12.0.0.6 or later, which contains the necessary fixes for the memory corruption issue. Organizations should also implement strict file validation policies that prevent automatic opening of .dwg files or other potentially dangerous file types, particularly in environments where users may encounter untrusted content. Network-based protections such as email filtering and web proxy configurations can help prevent malicious .dwg files from reaching end users. Additionally, system administrators should consider implementing application whitelisting policies that restrict the execution of IrfanView or the CADImage plugin to trusted environments only. The vulnerability aligns with ATT&CK technique T1203, which covers exploitation of remote services, and T1059, representing command and scripting interpreter usage, as attackers may leverage this vulnerability to establish persistent access or execute additional malicious payloads. Regular security assessments and vulnerability scanning should be conducted to identify systems running vulnerable versions of the software and ensure that all patches are properly deployed across the enterprise environment.