CVE-2017-2813 json
An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44.
published 2017-06-21 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11954
- cvss
- 8.8
- version 3.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known
Summary
An exploitable integer overflow vulnerability exists in the JPEG 2000 parser functionality of IrfanView 4.44. A specially crafted jpeg2000 image can cause an integer overflow leading to wrong memory allocation resulting in arbitrary code execution. Vulnerability can be triggered by viewing the image in via the application or by using thumbnailing feature of IrfanView.
Exploit prediction
1.72% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- Irfanview Irfanview
Classification
- Weakness
-
- CWE-190 Integer Overflow or Wraparound
References
-
securityfocus.com
/bid/98046
vdb-entry, third-party-advisory
-
talosintelligence.com
/vulnerability_reports/TALOS-2017-0310
third-party-advisory
Sources
- CVE List CVE-2017-2813
- NVD CVE-2017-2813
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.