CVE-2017-10742
HighSummary
XnView Classic version 2.40 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file. The issue is related to a Data Execution Prevention Violation.
Risk Assessment
Exploitation of this vulnerability could lead to system compromise or disruption, posing a significant security threat to the organization.
Recommendation
It is recommended to update XnView Classic to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in XnView Classic 2.40 for Windows
See all- CVE-2017-14278High
XnView Classic version 2.40 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a 'Read Access Violation'.
- CVE-2017-9903High
XnView Classic version 2.40 for Windows allows remote attackers to execute code via a crafted .fpx file. The issue relates to code flow control from a faulting address.
- CVE-2017-9893High
XnView Classic version 2.40 for Windows allows remote attackers to execute code via a crafted .fpx file. The issue is related to a User Mode Write AV concerning the gffGetFormatInfo function.
Original NVD description (English source)
XnView Classic for Windows Version 2.40 allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file, related to a "Data Execution Prevention Violation starting at Unknown Symbol @ 0x00000000380a0500 called from ntdll_77df0000!LdrxCallInitRoutine+0x0000000000000016."