Vulnerability in IrfanView

[ Description ]Official description

A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4319

  Irfan Skiljan IrfanView: Vulnerability allows an unspecified attack Translated from German

  Risk mediumCVE-2026-121517

[ References ]References

• github.com/dwBruijn/CVEs/blob/main/IrfanView/TIFF/Tiff_Wang.md
• vuldb.com/cve/CVE-2026-121517
• vuldb.com/submit/1018543
• vuldb.com/vuln/430288
• vuldb.com/vuln/430288/cti
• www.irfanview.com