CVE-2004-1726: John Bradley Xv

High severity, CVSS 7.5. EPSS: 3.8% chance of exploitation in the next 30 days.

Multiple integer overflows in (1) xviris.c, (2) xvpcx.c, and (3) xvpm.c in XV allow remote attackers to execute arbitrary code via a crafted image file that triggers a heap-based buffer overflow.

Affected products

• John Bradley Xv: version 3.10a only

Published 2004-08-20. Last modified 2026-06-16.