Description
A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| XnView | Classic | 2.52.5 | 2.52.6 |
References
- VDB-414926 | XnView Classic FLI File heap-based overflow vdb-entry technical-description
- VDB-414926 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-107125 | CVE Analysis and Report third-party-advisory
- Submit #993948 | XnSoft XnView 2.52.5.0 Heap Buffer Overflow Remote Code Execution third-party-advisory
- https://newsgroup.xnview.com/viewtopic.php?t=51359 related
- https://www.xnview.com/en/xnview/#downloads patch