CVE-2024-11519: 
IrfanView vulnerability analysis and mitigation

CVE-2024-11519 is a memory corruption vulnerability in IrfanView that allows remote code execution. The vulnerability was discovered and reported by Mat Powell of Trend Micro Zero Day Initiative, with the initial disclosure on November 21, 2024. This security flaw affects IrfanView version 4.67 (both x64 and x86 versions) and is related to the parsing of RLE files (Zero Day Initiative).

The vulnerability exists within the parsing of RLE files in IrfanView and stems from improper validation of user-supplied data, resulting in a memory corruption condition. It has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-787 (Out-of-bounds Write) and CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) (NVD).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. The impact is significant as it could lead to complete compromise of the system running the vulnerable application, with the code executing in the context of the current process (Zero Day Initiative).

The vulnerability has been fixed in IrfanView version 4.70 with plugins version 4.70. Users are advised to upgrade to this version to mitigate the risk (Zero Day Initiative).