CVE-2025-7266: 
IrfanView vulnerability analysis and mitigation

IrfanView CADImage Plugin contains a memory corruption vulnerability in the parsing of DXF files (CVE-2025-7266). The vulnerability was discovered in February 2025 and publicly disclosed on July 8th, 2025. This security flaw affects IrfanView CADImage Plugin versions prior to 4.72 for both x86 and x64 architectures (Zero Day Initiative).

The vulnerability exists within the parsing of DXF files and stems from improper validation of user-supplied data, which can result in a memory corruption condition. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (HIGH) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The flaw is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) (Zero Day Initiative).

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of IrfanView CADImage Plugin. The high severity rating indicates potential complete compromise of system confidentiality, integrity, and availability (Zero Day Initiative).

The vulnerability has been fixed in IrfanView CADImage Plugin version 4.72. Users are advised to upgrade to this version or later to mitigate the risk (Zero Day Initiative).