CVE-2024-9767 is an out-of-bounds read vulnerability in IrfanView, specifically affecting its SID file parsing. This flaw allows remote attackers to execute arbitrary code on a user's system if they open a malicious file or visit a malicious page. Rated 7.8 HIGH on CVSS, it requires user interaction (UI:R) but can lead to high impact (C:H, I:H, A:H) once triggered. Currently, there is no public exploit code, Metasploit module, or significant community discussion, and it is not listed on the KEV catalog, indicating low active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
4.66CPE matchmatch criteria | cpe:2.3:a:irfanview:irfanview:4.66:*:*:*:*:*:x64:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.