CVE-2025-7267: 
IrfanView vulnerability analysis and mitigation

IrfanView CADImage Plugin contains a remote code execution vulnerability (CVE-2025-7267) that affects the DXF file parsing functionality. The vulnerability was discovered in early 2025 and publicly disclosed on July 8th, 2025. The issue affects IrfanView CADImage Plugin versions prior to 15.0.0.8 for both x64 and x86 architectures, as well as IrfanView versions before 4.72 (Zero Day Initiative).

The vulnerability stems from an out-of-bounds read condition during the parsing of DXF files. The specific flaw exists due to the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness has been classified as CWE-125 (Out-of-bounds Read) (Zero Day Initiative).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. The attacker can leverage this vulnerability to execute code in the context of the current process, potentially gaining control over the affected system (Zero Day Initiative).

The vulnerability has been fixed in IrfanView CADImage Plugin version 15.0.0.8 and IrfanView version 4.72. Users are advised to upgrade to these versions or later to mitigate the risk (Zero Day Initiative).