CVE-2025-7240: 
IrfanView vulnerability analysis and mitigation

CVE-2025-7240 is a memory corruption vulnerability in IrfanView CADImage Plugin that affects DWG file parsing functionality. The vulnerability was discovered by Rocco Calvi and disclosed on July 8th, 2025. The affected software includes IrfanView CADImage Plugin versions prior to 4.72 (Zero Day Initiative).

The vulnerability exists within the parsing of DWG files in the IrfanView CADImage Plugin. The specific flaw stems from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating local access, low attack complexity, no privileges required, and user interaction required (Zero Day Initiative).

If successfully exploited, this vulnerability allows attackers to execute arbitrary code in the context of the current process. The high CVSS score reflects the potential for complete compromise of system confidentiality, integrity, and availability, though user interaction is required for successful exploitation (Zero Day Initiative).

The vulnerability has been fixed in IrfanView CADImage Plugin version 4.72. Users are advised to upgrade to this version or later to mitigate the risk (Zero Day Initiative).