CVE-2025-7268
IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.
The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26182.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Base score: 7.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.22%
- Percentile among all scored CVEs: 11
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
🎯 ATT&CK techniques
How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.
- Exploitation
T1203Exploitation for Client Executionexecution95 % - Primary impact
T1059Command and Scripting Interpreterexecution90 %
Lectura fuera de límites en análisis de archivos DXF requiere interacción del usuario (abrir archivo malicioso), clasificándose como T1203 (ejecución en cliente). Permite ejecución de código arbitrario (T1059).
Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.
🛡️ ATT&CK mitigations that cover these techniques
Affected technologies (1)
CWEs
- CWE-125
References
Raw JSON (NVD)
Show
{
"id": "CVE-2025-7268",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-7268",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-07-22T14:02:57.736413Z"
}
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "REQUIRED",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "zdi-disclosures@trendmicro.com",
"affectedData": [
{
"vendor": "IrfanView",
"product": "IrfanView",
"versions": [
{
"status": "affected",
"version": "4.70.0.0"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2025-07-21T20:15:48.420",
"references": [
{
"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-516/",
"tags": [
"Third Party Advisory"
],
"source": "zdi-disclosures@trendmicro.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "zdi-disclosures@trendmicro.com",
"description": [
{
"lang": "en",
"value": "CWE-125"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.\n\nThe specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26182."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecución remota de código al analizar archivos DXF en el complemento IrfanView CADImage. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en las instalaciones afectadas del complemento IrfanView CADImage. Para explotar esta vulnerabilidad, se requiere la interacción del usuario, ya que el objetivo debe visitar una página maliciosa o abrir un archivo malicioso. La falla específica se encuentra en el análisis de archivos DXF. El problema se debe a la falta de una validación adecuada de los datos proporcionados por el usuario, lo que puede provocar una lectura más allá del límite del búfer asignado. Un atacante puede aprovechar esta vulnerabilidad para ejecutar código en el contexto del proceso actual. Era ZDI-CAN-26182."
}
],
"lastModified": "2026-06-17T10:04:38.010",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cadsofttools:cadimage:*:*:*:*:*:irfanview:x64:*",
"vulnerable": true,
"matchCriteriaId": "D04C3EC4-8E8B-4FF3-960C-1833F86B67A9",
"versionEndExcluding": "15.0.0.8"
},
{
"criteria": "cpe:2.3:a:cadsofttools:cadimage:*:*:*:*:*:irfanview:x86:*",
"vulnerable": true,
"matchCriteriaId": "CD3AF73F-CA47-460E-BE55-ACC42C4CB22B",
"versionEndExcluding": "15.0.0.8"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:irfanview:irfanview:*:*:*:*:*:*:x64:*",
"vulnerable": false,
"matchCriteriaId": "44AB69A5-F65B-4A4D-A12C-FFB6317C39F4",
"versionEndExcluding": "4.72"
},
{
"criteria": "cpe:2.3:a:irfanview:irfanview:*:*:*:*:*:*:x86:*",
"vulnerable": false,
"matchCriteriaId": "D8298F15-CC7C-4927-BD5E-4F9034D48CA1",
"versionEndExcluding": "4.72"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "zdi-disclosures@trendmicro.com"
}