Live › vulnerability › CVE-2026-121517
IrfanView 4.76.0.0 on Windows has a heap-based buffer overflow in its TIFF Wang Annotation handler, triggered by a crafted image file. An attacker may be able to corrupt memory and run code, though the vendor says the option is off by default and the attack is hard to carry out.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Only Windows machines running IrfanView 4.76.0.0 with the TIF-Annotations option turned on are likely exposed, since the vendor says the option is off by default. Systems that open TIFF files from untrusted sources are the most relevant. Users who keep the option off are not affected according to the vendor.
No product ranges from the sources yet.
4.76.0.0.4.76.0.0: a patch is recommended by the source, but no fixed version is named.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".
This page as .md · .json · in your agent: get_signal("CVE-2026-121517")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.