CVE-2025-7238: 
IrfanView vulnerability analysis and mitigation

IrfanView CADImage Plugin contains a remote code execution vulnerability (CVE-2025-7238) that affects the DXF file parsing functionality. The vulnerability was discovered in early 2025 and publicly disclosed on July 8th, 2025. The issue affects IrfanView CADImage Plugin versions up to (excluding) 15.0.0.8 for both x64 and x86 architectures, as well as IrfanView versions up to (excluding) 4.72 (Zero Day Initiative).

The vulnerability stems from an out-of-bounds write issue during the parsing of DXF files, resulting from improper validation of user-supplied data. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High), with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The flaw is categorized under CWE-787 (Out-of-bounds Write) (Zero Day Initiative).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. The code execution occurs in the context of the current process, potentially leading to full system compromise (Zero Day Initiative).

The vulnerability has been fixed in IrfanView CADImage Plugin version 4.72. Users are advised to upgrade to this version or later to mitigate the risk (Zero Day Initiative).