What is CVE-2026-107125?

CVE-2026-107125 is a medium-severity vulnerability in Xnview Classic, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 6.3/10. Published 2026-10-07.

How severe is CVE-2026-107125?

Medium severity. CVSS v3 base score is 6.3 out of 10.

Buffer overflow in Xnview Classic

CVE-2026-107125

A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.

Vulnerability class: Buffer Overflow

Published 2026-10-07 · last modified 2026-10-07.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Xnview Classic — versions 2.52.5

Weakness classification (CWE)

References

vuldb.com/vuln/414926 (technical-description, vdb-entry)
vuldb.com/vuln/414926/cti (signature, permissions-required)
vuldb.com/cve/CVE-2026-107125 (third-party-advisory)
vuldb.com/submit/993948 (third-party-advisory)
newsgroup.xnview.com/viewtopic.php (related)
www.xnview.com/en/xnview/ (patch)

Frequently asked questions

What is CVE-2026-107125?: CVE-2026-107125 is a medium-severity vulnerability in Xnview Classic, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. CVSS score: 6.3/10. Published 2026-10-07.
How severe is CVE-2026-107125?: Medium severity. CVSS v3 base score is 6.3 out of 10.