IrfanView 4.76.0.0 on Win64 TIFF Wang Annotation heap-based overflow

Summaryinfo

A vulnerability described as critical has been identified in IrfanView 4.76.0.0 on Win64. Affected by this issue is some unknown functionality of the component TIFF Wang Annotation Handler. Executing a manipulation can lead to heap-based overflow. This vulnerability appears as CVE-2026-121517. The attack may be performed from remote. In addition, an exploit is available. Applying a patch is advised to resolve this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".

Detailsinfo

A vulnerability was found in IrfanView 4.76.0.0 on Win64. It has been declared as critical. This vulnerability affects an unknown code block of the component TIFF Wang Annotation Handler. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-121517. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available.

It is possible to download the exploit at github.com. It is declared as proof-of-concept. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".

Applying a patch is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Image Processing Software

Name

• IrfanView

Version

• 4.76.0.0

License

• free

Website

• Product: https://www.irfanview.com/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1018543: IrfanView 4.76.0.0 (x64) Heap-based Buffer Overflow (by dwbruijn)

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion