CVE-2012-0897

IrfanView < 4.33 - Remote Code Execution via JPEG2000 QCD Marker Segment

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2012-0897. PoCs published by Metasploit, including Metasploit module exploits/windows/fileformat/irfanview_jpeg2000_bof.

AI-analyzed exploit summary This Metasploit module exploits a stack-based buffer overflow in IrfanView's JPEG2000.dll plugin (CVE-2012-0897) by crafting a malicious JP2 file with a malformed qcd chunk. It uses an egghunter for stability and achieves remote code execution on vulnerable systems.

Description

Stack-based buffer overflow in the JPEG2000 plugin in IrfanView PlugIns before 4.33 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubylocalwindows
https://www.exploit-db.com/exploits/19519

This Metasploit module exploits a stack-based buffer overflow in IrfanView's JPEG2000.dll plugin (CVE-2012-0897) by crafting a malicious JP2 file with a malformed qcd chunk. It uses an egghunter for stability and achieves remote code execution on vulnerable systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: IrfanView <= 4.3.2.0 with JPEG2000 plugin
No auth needed
Prerequisites: Vulnerable version of IrfanView with JPEG2000 plugin installed · User interaction to open the malicious JP2 file
devstral-2 · analyzed Feb 16, 2026 Full analysis →
metasploit WORKING POC NORMAL
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/fileformat/irfanview_jpeg2000_bof.rb

This Metasploit module exploits a stack-based buffer overflow in IrfanView's JPEG2000 plugin (CVE-2012-0897) via a malformed qcd chunk in a JP2 file. It uses an egghunter for stability and achieves remote code execution on vulnerable systems.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: IrfanView <= 4.3.2.0 with JPEG2000 plugin
No auth needed
Prerequisites: Vulnerable version of IrfanView with JPEG2000 plugin · User interaction to open malicious JP2 file
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032529
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/47360
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/51426
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/78333
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032530
Various Sources x_refsource_confirm
http://www.irfanview.com/history_old.htm
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/72398

Scores

EPSS 0.5266
EPSS Percentile 98.8%

Details

CWE
CWE-119
Status published
Products (50)
irfanview/irfanview 1.70
irfanview/irfanview 1.75
irfanview/irfanview 1.80
irfanview/irfanview 1.85
irfanview/irfanview 1.90
irfanview/irfanview 1.95
irfanview/irfanview 1.97
irfanview/irfanview 1.98
irfanview/irfanview 1.98a
irfanview/irfanview 1.99
... and 40 more
Published Jan 20, 2012
Tracked Since Feb 18, 2026