The vulnerability of the DWG File Parser component of the CADImage plugin for IrfanView, a software for viewing and playing graphic, video, and audio files, allows a malicious actor to execute arbitrary code within the context of the current process.

🗓️ 11 Jul 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 1 Views

DWG File Parser in CADImage plugin for IrfanView has a buffer overread that could allow arbitrary code execution.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2025-7261	8 Jul 202503:00	–	circl
CNNVD	IrfanView CADImage Plugin 缓冲区错误漏洞	21 Jul 202500:00	–	cnnvd
CNVD	IrfanView CADImage Plugin Buffer Overflow Vulnerability (CNVD-2025-16825)	24 Jul 202500:00	–	cnvd
CVE	CVE-2025-7261	21 Jul 202519:56	–	cve
Cvelist	CVE-2025-7261 IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability	21 Jul 202519:56	–	cvelist
EUVD	EUVD-2025-22226	3 Oct 202520:07	–	euvd
NVD	CVE-2025-7261	21 Jul 202520:15	–	nvd
OSV	CVE-2025-7261	21 Jul 202520:15	–	osv
Positive Technologies	PT-2025-28691 · Irfanview +1 · Irfanview +1	11 Feb 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-7261	23 Jul 202521:33	–	redhatcve

Vulners

Node

irfan_skiljan irfanviewRange<4.72

Source	Link
irfanview	www.irfanview.com/plugins.htm
zerodayinitiative	www.zerodayinitiative.com/advisories/ZDI-CAN-26130/
vuldb	www.vuldb.com/
web	www.web.nvd.nist.gov/view/vuln/detail

11 Jul 2025 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 27.2

CVSS 37.8

EPSS0.00185

dwg file parser cadimage plugin irfanview plugin buffer overread arbitrary code execution