IrfanView CVE-2026-121517

Exploitation requires that the IrfanView TIF-Annotations option be manually enabled - the vendor confirms this feature is OFF by default, so normal/default installations are not affected. The victim must then open an attacker-supplied TIFF file carrying a crafted Wang annotation (UI:P - passive user interaction), on IrfanView 4.76.0.0 / Win64. Limiting factors: high attack complexity (the vendor and VulDB both note exploitation is difficult), the non-default configuration requirement, and the need for the user to open the malicious file. No authentication is required (PR:N), but these conditions substantially constrain realistic exploitation.

Signals align toward low real-world priority rather than a contradiction. The supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:P) yields a base-equivalent score of only 1.3, driven by high attack complexity (AC:H), required passive user interaction (UI:P), and low impact to confidentiality, integrity, and availability (VC:L/VI:L/VA:L). The vuln.today decision label is 'monitor' (not act_now or emergency). This is NOT in CISA KEV - there is no confirmed active exploitation. EPSS is not provided in the input, so exploitation probability cannot be quantified. A public PoC reference exists (a GitHub writeup), but it is not verified as working exploit code, so it should not be equated with a reliable weaponized exploit. Crucially, the vendor confirms the vulnerable TIF-Annotations feature is OFF by default and rates the danger 'low,' meaning default installations are not exposed. The net picture is a genuinely low-priority issue: a high-CVSS class (heap overflow) that in practice is hard to exploit, limited to a non-default configuration, requires user interaction, and has only low assessed impact. No signals conflict here - severity, decision label, and vendor statement are consistent.

An attacker crafts a malicious TIFF file containing a manipulated Wang annotation and delivers it to a victim (e.g., via email or a download) who has manually enabled the non-default TIF-Annotations option in IrfanView 4.76.0.0 on Win64. When the victim opens the file, the annotation handler triggers a heap-based buffer overflow. A public PoC reference exists but is not verified as working exploit code, and the high attack complexity means reliable exploitation is difficult.