CVE-2009-0197: Irfanview Formats

High severity, CVSS 9.3. EPSS: 4.8% chance of exploitation in the next 30 days.

Integer overflow in the FORMATS Plugin before 4.23 for IrfanView allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a large XPM file that triggers a heap-based buffer overflow.

Affected products

• Irfanview Formats: up to and including 4.22; version 4.00 only; version 4.10 only; version 4.20 only

Published 2009-04-09. Last modified 2026-06-16.