CVE-2017-9903
HighSummary
XnView Classic version 2.40 for Windows allows remote attackers to execute code via a crafted .fpx file. The issue relates to code flow control from a faulting address.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a significant threat to system and user data security.
Recommendation
It is recommended to update XnView Classic to the latest version to mitigate this vulnerability and to monitor systems for suspicious .fpx files.
Other vulnerabilities in XnView Classic 2.40 for Windows
See all- CVE-2017-14278High
XnView Classic version 2.40 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a 'Read Access Violation'.
- CVE-2017-9893High
XnView Classic version 2.40 for Windows allows remote attackers to execute code via a crafted .fpx file. The issue is related to a User Mode Write AV concerning the gffGetFormatInfo function.
- CVE-2017-10742High
XnView Classic version 2.40 for Windows allows attackers to execute arbitrary code or cause a denial of service via a crafted .rle file. The issue is related to a Data Execution Prevention Violation.
Original NVD description (English source)
XnView Classic for Windows Version 2.40 allows remote attackers to execute code via a crafted .fpx file, related to "Data from Faulting Address controls Code Flow starting at Xfpx+0x00000000000117ff."