Irfanview Wpg vulnerabilities

2 CVEs affecting Irfanview Wpg, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-27362, published 2021-02-17.

More from Irfanview.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-27224, published 2021-02-17. High severity, CVSS 7.5. EPSS: 38% chance of exploitation in the next 30 days. The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a user-mode write access violation starting at WPG+0x0000000000012ec6, which might allow remote attackers to execute arbitrary code.
• CVE-2021-27362, published 2021-02-17. Critical severity, CVSS 9.8. EPSS: 4.5% chance of exploitation in the next 30 days. The WPG plugin before 3.1.0.0 for IrfanView 4.57 has a Read Access Violation on Control Flow starting at WPG!ReadWPG_W+0x0000000000000133, which might allow remote attackers to execute arbitrary code.