CVE-2017-9893
HighSummary
XnView Classic version 2.40 for Windows allows remote attackers to execute code via a crafted .fpx file. The issue is related to a User Mode Write AV concerning the gffGetFormatInfo function.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a significant threat to system and user data security.
Recommendation
It is recommended to update XnView Classic to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in XnView Classic 2.40 for Windows
See all- CVE-2017-14278High
XnView Classic version 2.40 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a 'Read Access Violation'.
- CVE-2017-9903High
XnView Classic version 2.40 for Windows allows remote attackers to execute code via a crafted .fpx file. The issue relates to code flow control from a faulting address.
- CVE-2017-10742High
XnView Classic version 2.40 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file. The issue is related to a Data Execution Prevention Violation.
Original NVD description (English source)
XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to a "User Mode Write AV starting at Xfpx!gffGetFormatInfo+0x0000000000012548."