---
id: "CVE-2026-121517"
kind: "vulnerability"
aliases: ["CVE-2026-121517"]
title: "IrfanView: TIFF Wang Annotation handler heap overflow allows remote attack"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["irfanview", "package", "tiff", "windows"]
not_affected_if: ["default-config", "tif-annotations-off"]
published_at: "2026-11-03T21:17:37+00:00"
first_seen_at: "2026-11-03T21:19:30+00:00"
updated_at: "2026-11-03T21:20:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121517", "first_seen_at": "2026-11-03T21:19:30+00:00"}]
---

# IrfanView: TIFF Wang Annotation handler heap overflow allows remote attack

IrfanView 4.76.0.0 on Windows has a heap-based buffer overflow in its TIFF Wang Annotation handler, triggered by a crafted image file. An attacker may be able to corrupt memory and run code, though the vendor says the option is off by default and the attack is hard to carry out.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Open IrfanView and check whether the TIFF Wang Annotation option (TIF-Annotations) is enabled in the TIFF options.
- Check the installed version (Help > About) for `4.76.0.0`.

## Fix

- IrfanView `4.76.0.0`: a patch is recommended by the source, but no fixed version is named.

## Timeline

- 2026-11-03T21:19:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121517

## From the sources

A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_