CVE-2021-29358 in IrfanView
Summary
by MITRE • 09/28/2021
A buffer overflow vulnerability in FORMATS!ReadPVR_W+0xfa of Irfanview 4.57 allows attackers to cause a denial of service (DOS) via a crafted PVR file.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 05/06/2026
The buffer overflow vulnerability identified as CVE-2021-29358 resides within the IrfanView image viewer application version 4.57 specifically in the FORMATS!ReadPVR_W+0xfa function. This flaw manifests when processing specially crafted PVR (PowerVR) image files, which are commonly used in mobile gaming and embedded systems due to their compressed format and efficient texture handling. The vulnerability represents a classic buffer overflow condition where insufficient bounds checking occurs during the parsing of PVR file headers and data structures, allowing an attacker to write beyond the allocated memory buffer.
The technical implementation of this vulnerability involves the improper handling of memory allocation when reading PVR format files through the IrfanView application. When the application encounters a malformed PVR file containing oversized data fields or incorrect header values, the ReadPVR_W function fails to validate the input parameters before copying data into fixed-size buffers. This condition creates a situation where attacker-controlled data can overwrite adjacent memory locations, potentially leading to application instability or complete crash. The vulnerability specifically targets the PVR file format which uses specific header structures including magic numbers, dimensions, and compression information that when manipulated can trigger the overflow condition.
The operational impact of this vulnerability is primarily focused on denial of service conditions, where an attacker can cause IrfanView to crash or become unresponsive when attempting to open a maliciously crafted PVR file. While the vulnerability does not appear to enable arbitrary code execution based on the description, the potential for system instability represents a significant risk in environments where image viewing applications are frequently used or automatically invoked. The vulnerability affects any system running IrfanView 4.57 or earlier versions, making it particularly concerning for enterprise environments where this application may be deployed across multiple endpoints or used in automated processes.
Security professionals should consider this vulnerability in the context of the CWE-121 buffer overflow classification which encompasses stack-based and heap-based buffer overflows that can lead to arbitrary code execution or denial of service conditions. The attack vector aligns with ATT&CK technique T1203 (Exploitation for Client Execution) and T1499.004 (Endpoint Denial of Service) as it leverages file format parsing to induce system instability. Organizations should prioritize updating to IrfanView version 4.58 or later, which contains the necessary patches to address this vulnerability. Additionally, implementing file validation controls and restricting user access to potentially malicious file formats can serve as effective mitigations. Network-based protections should also consider blocking PVR files from untrusted sources and implementing sandboxing mechanisms when processing image files to prevent exploitation attempts.