8.8high
CVE-2017-2813
An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44.
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.7%
percentile 78%
Public exploits
0
none known
Summary
An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44. A specially crafted jpeg2000 image can cause an integer overflow leading to wrong memory allocation resulting in arbitrary code execution. Vulnerability can be triggered by viewing the image in via the application or by using thumbnailing feature of IrfanView.
Exploit prediction (EPSS)
1.72% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- Irfanview Irfanview
Classification
- Weakness
- CWE-190 Integer Overflow or Wraparound
References
- securityfocus.com /bid/98046 · vdb-entry, x_refsource_BID, x_transferred
- talosintelligence.com /vulnerability_reports/TALOS-2017-0310 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2017-2813
- NVD: CVE-2017-2813
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.