Buffer overflow in Irfanview

CVE-2013-6932

Buffer overflow in IrfanView before 4.37, when a multibyte-character directory name is used, allows user-assisted remote attackers to execute arbitrary code via a crafted file that is incorrectly handled by the Thumbnail tooltips feature in the Thumbnails window.

Vulnerability class: Buffer Overflow

EPSS: 0.057 (92.3th percentile) — read the EPSS interpretation.

Affected products

Irfanview — versions 4.00, 4.10, 4.20
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

References

vultures@jpcert.or.jp (x_refsource_JVN, third-party-advisory)
vultures@jpcert.or.jp (x_refsource_CONFIRM)
vultures@jpcert.or.jp (x_refsource_JVNDB, third-party-advisory)