Xnview
CVE-2013-3938
CRITICAL
Severity by source
AV:N/AC:M/Au:N/C:C/I:C/A:C
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
AV:N/AC:M/Au:N/C:C/I:C/A:C
Lifecycle Timeline
1DescriptionCVE.org
Integer overflow in xnview.exe in XnView 2.13 allows remote attackers to execute arbitrary code via a large NUM_ELEMENTS field in an IFD_ENTRY structure in a JXR file, which triggers a heap-based buffer overflow.
AnalysisAI
Integer overflow in xnview.exe in XnView 2.13 allows remote attackers to execute arbitrary code via a large NUM_ELEMENTS field in an IFD_ENTRY structure in a JXR file, which triggers a heap-based. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Epss exploitation probability 12.2% and no vendor patch available.
Technical ContextAI
This vulnerability is classified under CWE-189. Integer overflow in xnview.exe in XnView 2.13 allows remote attackers to execute arbitrary code via a large NUM_ELEMENTS field in an IFD_ENTRY structure in a JXR file, which triggers a heap-based buffer overflow. Affected products include: Xnview.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format plugin in XnView 1.99 and 1.99
Buffer overflow in XnView before 2.04 allows remote attackers to execute arbitrary code via a crafted PCT file. Rated cr
Multiple heap-based buffer overflows in XnView before 1.99 allow remote attackers to cause a denial of service (applicat
Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash
Heap-based buffer overflow in XnView before 1.99 allows remote attackers to cause a denial of service (application crash
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003283eb. Rated high severity (CVSS 7.8), this
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328384. Rated high severity (CVSS 7.8), this
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000327a07. Rated high severity (CVSS 7.8), this
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e566. Rated high severity (CVSS 7.8), this
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000328165. Rated high severity (CVSS 7.8), this
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x00000000003273aa. Rated high severity (CVSS 7.8), this
XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x000000000032e849. Rated high severity (CVSS 7.8), this
Same weakness CWE-189 – Numeric Errors
View allShare
External POC / Exploit Code
Leaving vuln.today