CVE-2024-11513: 
IrfanView vulnerability analysis and mitigation

CVE-2024-11513 is a heap-based buffer overflow vulnerability in IrfanView's ECW file parsing functionality, discovered and reported on May 9, 2024. The vulnerability affects IrfanView version 4.67 for both x64 and x86 architectures. This security flaw was assigned a CVSS v3.1 base score of 7.8 (HIGH) (NVD, ZDI Advisory).

The vulnerability exists within the parsing of ECW files in IrfanView. The specific flaw stems from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. This issue has been classified as CWE-787 (Out-of-bounds Write) and CWE-122 (Heap-based Buffer Overflow) (NVD).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of IrfanView. The vulnerability has received a CVSS v3.1 base score of 7.8, indicating high severity with potential for complete compromise of confidentiality, integrity, and availability (ZDI Advisory).

The vulnerability has been fixed in IrfanView version 4.70 with plugins version 4.70. Users are advised to upgrade to this version to mitigate the risk (ZDI Advisory).