CVE-2025-7325

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DXF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-26434.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Jul 21, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-73267.0Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only ECVE-2025-73278.8The Widget for Google Reviews plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.15 via theCVE-2025-73289.8Multiple Broken Authentication security issues exist in the affected product. The security issues are due to missing authentication checks oCVE-2025-73294.8A Stored Cross-Site Scripting security issue exists in the affected product that could potentially allow a malicious user to view and modifyCVE-2025-73306.5A cross-site request forgery security issue exists in the product and version listed. The vulnerability stems from missing CSRF checks on thCVE-2025-73376.5An issue has been discovered in GitLab CE/EE affecting all versions from 7.8 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that CVE-2025-73387.5Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and priorCVE-2025-73393.4on-headers is a node.js middleware for listening to when a response writes headers. A bug in on-headers versions `<1.1.0` may result in respCVE-2025-73409.8The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary fileCVE-2025-73419.8The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary fileCVE-2025-73427.5A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build processCVE-2025-73439.8The SFT developed by Digiwin has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands t