CVE-2025-7322: 
IrfanView vulnerability analysis and mitigation

IrfanView CADImage Plugin contains a vulnerability that was discovered in February 2025 and publicly disclosed on July 8, 2025. The vulnerability, identified as CVE-2025-7322, affects the DWG file parsing functionality in IrfanView CADImage Plugin versions prior to 4.72. This security flaw was reported by security researcher Rocco Calvi (@TecR0c) with TecSecurity (Zero Day Initiative).

The vulnerability is an out-of-bounds read issue that exists within the parsing of DWG files. The specific flaw stems from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 7.8 (High) with the vector string AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (Zero Day Initiative).

If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code in the context of the current process on affected installations of IrfanView CADImage Plugin. The successful exploitation could lead to complete system compromise, potentially allowing attackers to execute malicious code with the same privileges as the compromised process (Zero Day Initiative).

The vulnerability has been fixed in IrfanView CADImage Plugin version 4.72. Users are advised to upgrade to this version or later to mitigate the risk (Zero Day Initiative).