IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the IrfanView CADImage Plugin, specifically within the parsing of DWG files. The issue arises from inadequate validation of user-supplied data, leading to out-of-bounds read conditions that can be exploited to execute arbitrary code in the context of the current process. Exploitation requires user interaction, such as opening a malicious DWG file.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system.

Remediation

The vulnerability has been fixed in IrfanView CADImage Plugin version 4.72.