XnView Classic CVE-2026-107125

Exploitation requires a victim to open an attacker-crafted FLI format file in XnView Classic 2.52.5, where the parser mishandles the starting_line argument in the FLI File Parser component (CWE-122 heap overflow). The governing limiting factor is mandatory user interaction (CVSS UI:P): the attacker cannot trigger the flaw without the user opening the malicious file, so delivery relies on social engineering (email attachment, web download, or file share). No authentication is required (PR:N), but no server-side or default-listening service is exposed - this is strictly a client-side file-parsing condition affecting the XnView Classic desktop application.

This is a moderate-severity, low-priority issue despite the exploitable memory-corruption class. The CVSS 4.0 base vector (AV:N/AC:L/PR:N/UI:P/VC:L/VI:L/VA:L) scores 5.3 (Medium) and critically requires user interaction (UI:P) - a victim must open a maliciously crafted FLI file - so this is not a server-side remote flaw but a client-side file-parsing bug. The threat metric E:P indicates proof-of-concept exploit maturity, meaning exploit code exists but there is no evidence of active exploitation. No EPSS score is provided and the CVE is NOT listed in CISA KEV, so there is no signal of in-the-wild abuse; the impacts are rated Low across confidentiality, integrity, and availability rather than full code execution, which tempers the risk from a CWE-122 heap overflow. The signals are internally consistent: a PoC-stage, user-interaction-gated client vulnerability in a desktop image viewer. Note that the description says 'Remote exploitation is possible,' which reflects that the malicious file can be delivered over a network (AV:N), NOT that an attacker can reach the parser without victim action - the UI:P requirement is the governing limitation.

An attacker crafts a malicious FLI animation file with a manipulated starting_line argument and delivers it via email, a web download, or a shared drive. When a victim opens the file in XnView Classic 2.52.5, the FLI parser triggers a heap-based buffer overflow. A proof-of-concept exists (CVSS E:P), but impacts are rated Low, so realistic outcomes range from application crash to limited memory corruption rather than confirmed reliable code execution.