CVE-2021-29364: 
IrfanView vulnerability analysis and mitigation

A buffer overflow vulnerability was discovered in IrfanView version 4.57, specifically in the Formats!ReadRAS_W+0x1001 component. The vulnerability allows attackers to execute arbitrary code through a specially crafted RLE file (NVD, ManageEngine).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVSS v2.0 base score is 6.8 (MEDIUM) with vector (AV:N/AC:M/Au:N/C:P/I:P/A:P). The vulnerability is classified as CWE-787 (Out-of-bounds Write) (NVD).

If successfully exploited, this vulnerability could allow attackers to execute arbitrary code in the context of the current user when processing a maliciously crafted RLE file. This could potentially lead to unauthorized access, data manipulation, or system compromise (NVD).

The vulnerability requires user interaction to exploit, as the victim must open a maliciously crafted RLE file. The attack complexity is considered low, and no special privileges are required to execute the attack (NVD).

The vulnerability affects IrfanView version 4.57. Users are advised to update to a newer version of the software that contains the security fix (GitHub Research).