{"id":"CVE-2026-121517","kind":"vulnerability","aliases":["CVE-2026-121517"],"related":[],"title":"IrfanView: TIFF Wang Annotation handler heap overflow allows remote attack","description":"A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: \"[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low\".","summary":"IrfanView 4.76.0.0 on Windows has a heap-based buffer overflow in its TIFF Wang Annotation handler, triggered by a crafted image file. An attacker may be able to corrupt memory and run code, though the vendor says the option is off by default and the attack is hard to carry out.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["irfanview","package","tiff","windows"],"not_affected_if":["default-config","tif-annotations-off"],"how_to_check":"- Open IrfanView and check whether the TIFF Wang Annotation option (TIF-Annotations) is enabled in the TIFF options.\n- Check the installed version (Help > About) for `4.76.0.0`.","fix":"- IrfanView `4.76.0.0`: a patch is recommended by the source, but no fixed version is named.","status":"open","published_at":"2026-11-03T21:17:37+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","triaged_at":"2026-11-03T21:20:45+00:00","updated_at":"2026-11-03T21:20:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T21:20:45Z","model":"claude-haiku-5-5","output":{"fix":"- IrfanView `4.76.0.0`: a patch is recommended by the source, but no fixed version is named.","reach":"internet","title":"IrfanView: TIFF Wang Annotation handler heap overflow allows remote attack","impact":"high","summary":"IrfanView 4.76.0.0 on Windows has a heap-based buffer overflow in its TIFF Wang Annotation handler, triggered by a crafted image file. An attacker may be able to corrupt memory and run code, though the vendor says the option is off by default and the attack is hard to carry out.","audience":"everyone","category":"package","nicknames":[],"who_cares":["irfanview","windows","tiff"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Heap overflow could let an attacker run code on the machine","analyst_note":"Confirm the fixed IrfanView version and whether the exploit is public; the sources do not name a fix and the vendor's risk claim conflicts with the NVD medium score.","how_to_check":"- Open IrfanView and check whether the TIFF Wang Annotation option (TIF-Annotations) is enabled in the TIFF options.\n- Check the installed version (Help > About) for `4.76.0.0`.","plain_action":"If you use IrfanView on Windows, check that its TIFF Wang Annotation option is off and wait for the developer to release a fixed version.","needs_analyst":true,"not_affected_if":["default-config","tif-annotations-off"],"who_is_affected":"Only Windows machines running IrfanView 4.76.0.0 with the TIF-Annotations option turned on are likely exposed, since the vendor says the option is off by default. Systems that open TIFF files from untrusted sources are the most relevant. Users who keep the option off are not affected according to the vendor.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000754,"input_tokens":4223,"output_tokens":663,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121517':13A,16A '-2026':12A,15A '4.76.0.0':22B,78C 'abl':48B 'affect':81C,167C 'allow':8A 'annot':4A,36B,94C,156C 'appear':125C 'appli':142C 'attack':10A,45B,67B,107C,119C 'base':29B,103C 'buffer':30B,104C 'carri':71B,112C 'code':54B 'complex':116C 'compon':91C 'confirm':151C 'corrupt':50B 'craft':41B 'cve':11A,14A 'danger':169C 'default':64B,161C 'detect':75C 'difficult':128C 'exploit':124C,130C 'file':43B 'fix':146C 'function':88C 'handler':5A,37B,95C 'hard':69B 'heap':6A,28B,102C 'heap-bas':27B,101C 'high':122C 'imag':42B 'irfanview':1A,17B,21B,77C 'issu':148C 'level':170C 'low':174C 'manipul':98C 'may':46B,135C 'mean':162C 'memori':51B 'normal':163C 'option':60B,157C 'overflow':7A,31B,105C 'packag':18B 'patch':144C 'perform':96C 'possibl':109C 'public':133C 'rather':121C 'recommend':140C 'remot':9A,114C 'result':99C 'run':53B 'say':58B 'though':55B 'tif':155C 'tif-annot':154C 'tiff':2A,19B,34B,92C 'trigger':38B 'unknown':87C 'use':137C 'user':164C 'vendor':57B,150C 'vulner':73C,84C 'wang':3A,35B,93C 'win64':80C 'window':20B,24B","nicknames":[],"mitigations":[],"who_affected":"Only Windows machines running IrfanView 4.76.0.0 with the TIF-Annotations option turned on are likely exposed, since the vendor says the option is off by default. Systems that open TIFF files from untrusted sources are the most relevant. Users who keep the option off are not affected according to the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"everyone","plain_action":"If you use IrfanView on Windows, check that its TIFF Wang Annotation option is off and wait for the developer to release a fixed version.","pkeys":[],"ptokens":[],"labels":["irfanview","medium","package","tiff","windows"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121517","severity":null,"published_at":"2026-11-03T21:17:37+00:00","modified_at":"2026-11-03T21:17:37+00:00","first_seen_at":"2026-11-03T21:19:30+00:00","fetched_at":"2026-11-03T21:19:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}