CVE-2021-28835: 
XnView vulnerability analysis and mitigation

A Buffer Overflow vulnerability was discovered in XnView software versions before 2.50, identified as CVE-2021-28835. The vulnerability allows local attackers to execute arbitrary code via a crafted GEM bitmap file. The issue was discovered and fixed in early 2021, affecting all XnView installations prior to version 2.50 (XnView Changelog, NVD).

The vulnerability is classified as a Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') under CWE-120. It received a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access required, low attack complexity, no privileges required, and user interaction needed (NVD).

The vulnerability can lead to arbitrary code execution on affected systems when processing specially crafted GEM bitmap files. This could potentially allow attackers to gain control of the affected system with the same privileges as the user running XnView (NVD).

The vulnerability requires local access and user interaction, specifically opening a maliciously crafted GEM bitmap file using an affected version of XnView. The attack complexity is considered low, making it relatively straightforward to exploit once the preconditions are met (NVD).

The vulnerability was patched in XnView version 2.50. Users are advised to upgrade to version 2.50 or later to mitigate this security risk. The fix was specifically mentioned in the version 2.50 changelog as 'GEM vulnerability - Thanks to Michael Heinzl' (XnView Forum).