CVE-2026-107125 in Classic
Summary
by MITRE • 10/07/2026
A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in XnView Classic versions prior to 2.52.6 represents a critical security flaw within its FLI File Parser component, specifically affecting an unknown function that processes animation files. This software is widely used for viewing and managing image formats, including the FLC/FLI format which was historically popular for computer animations. The core technical issue stems from improper validation of input data during the parsing process. When a maliciously crafted FLI file is processed, the application fails to correctly verify the bounds or integrity of specific arguments, particularly those related to starting line indices within the image structure. This lack of rigorous boundary checking allows an attacker to supply argument values that exceed the allocated memory limits for internal buffers.
The technical nature of this flaw is classified as a heap-based buffer overflow, which corresponds directly with CWE-122 in the Common Weakness Enumeration taxonomy. In this scenario, data written into a heap-allocated buffer exceeds its size limit due to the manipulation of the starting_line argument. Because the allocation occurs on the heap rather than the stack, the consequences are particularly severe and complex to mitigate through simple compiler protections like stack canaries alone. The overflow allows for arbitrary write operations in memory, which an attacker can leverage to overwrite adjacent data structures or control flow pointers. This capability provides a pathway for executing arbitrary code with the privileges of the user running the application, effectively compromising the integrity and confidentiality of the system.
From an operational perspective, this vulnerability is remotely exploitable, meaning that an attack does not require physical access or local authentication on the target machine. An attacker can distribute a malicious FLI file through various vectors such as email attachments, compromised websites hosting image galleries, or shared network drives. When a victim opens the crafted file using XnView Classic 2.52.5 or earlier versions, the parser triggers the overflow condition automatically during normal operation. This aligns with ATT&CK technique T1203, which covers Exploitation for Client Execution, as the attack relies on tricking the user into opening a malicious document that exploits client-side software vulnerabilities. The successful exploitation could lead to full system compromise, installation of malware, or use of the machine in botnets without further interaction from the victim after the initial file open action.
Mitigation strategies focus primarily on immediate patch management and defensive configuration measures. The most effective remediation is upgrading XnView Classic to version 2.52.6 or later, where the developers have addressed the input validation flaws within the FLI File Parser. Until an upgrade can be performed in environments with strict change control windows, users should exercise extreme caution when opening image files from untrusted sources. Disabling automatic preview features for unknown file types and employing application whitelisting policies can also reduce the attack surface by preventing unauthorized or unexpected execution of the vulnerable binary. Additionally, deploying endpoint detection and response solutions that monitor for anomalous memory allocation patterns may help detect exploitation attempts in real-time, although prevention through patching remains the primary defense against this heap-based buffer overflow vulnerability.