CVE-2025-7242: 
IrfanView vulnerability analysis and mitigation

CVE-2025-7242 is a vulnerability affecting the IrfanView CADImage Plugin that was discovered in early 2025. This vulnerability specifically impacts the DWG file parsing functionality and was reported through the Zero Day Initiative (ZDI-CAN-26088). The affected software versions include IrfanView CADImage Plugin versions up to (excluding) 15.0.0.8 for both x64 and x86 architectures, and IrfanView versions up to (excluding) 4.72 (Zero Day Initiative).

The vulnerability is classified as an Out-of-Bounds Read Remote Code Execution vulnerability. The specific flaw exists within the parsing of DWG files and results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS 3.0 base score of 7.8 (HIGH) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Zero Day Initiative).

An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process on affected installations of IrfanView CADImage Plugin. The vulnerability affects both confidentiality, integrity, and availability of the system, as indicated by the CVSS scoring (Zero Day Initiative).

User interaction is required to exploit this vulnerability, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges for execution (Zero Day Initiative).

The vulnerability has been fixed in IrfanView CADImage Plugin version 4.72. Users are advised to upgrade to this version or later to mitigate the vulnerability (Zero Day Initiative).