CVE-2026-121517 Details
Description
A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".
A heap-based buffer overflow vulnerability has been identified in IrfanView version 4.76.0.0 for Win64. The issue arises in the TIFF Wang Annotation Handler, which processes embedded Wang annotation records. Due to an integer overflow in the length field of the annotation, an attacker can manipulate the data being read and cause a heap overflow. This vulnerability can be exploited remotely, although the complexity of the attack is considered high.
Users are advised to update to the latest version of IrfanView, as the vendor has acknowledged the vulnerability and recommended applying a patch.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 3, 2026CISA-ADP
Assessed Nov 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dwBruijn/CVEs/blob/main/IrfanView/TIFF/Tiff_Wang.md | CISA-ADP | ExploitTechnical Analysis |
| https://github.com/dwBruijn/CVEs/blob/main/IrfanView/TIFF/Tiff_Wang.md | [email protected] | ExploitTechnical Analysis |
| https://vuldb.com/cve/CVE-2026-121517 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1018543 | [email protected] | Permission Required |
| https://vuldb.com/vuln/430288 | [email protected] | Permission Required |
| https://vuldb.com/vuln/430288/cti | [email protected] | Content Wall |
| https://www.irfanview.com/ | [email protected] | ProductVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | [email protected] |
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| IrfanView | 4.76.0.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 7, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2026 | New CVE Received | [email protected] |