Vulnerability Spotlight: Irfan View Jpeg2000 Reference Tile width Arbitrary Code Execution Vulnerability
Summary: Cisco Talos disclosed TALOS-2017-0310 / CVE-2017-2813, an arbitrary code execution vulnerability in the JP2 plugin for the Windows image viewer IrfanView, found by Aleksandar Nikolic. Insufficient checks on the reference tile width value in a buffer size allocation cause an integer overflow, a small buffer allocated for a large tile, and a controlled out of bounds write that can be leveraged for code execution, triggered by viewing an image or using the thumbnailing feature.
Key Takeaway: Exploitation requires only that a user view a crafted image or let IrfanView thumbnail it, so the attack surface is the routine act of opening a file rather than any privileged operation. An updated plugin is available, and Snort rules 42177 and 42178 detect exploitation attempts.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2017-2813
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026