CVE-2013-3937: Xnview

High severity, CVSS 7.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Heap-based buffer overflow in xnview.exe in XnView before 2.13 allows remote attackers to execute arbitrary code via the biBitCount field in a BMP file.

Affected products

• Xnview Xnview: before 2.13 (fixed in 2.13)

Published 2020-01-02. Last modified 2026-06-16.