CVE-2020-13880

IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write

Critical · published January 5, 2024

CVSS v3.1
9.8
EPSS
1%
Percentile
45.9
In the wild
Unconfirmed
What it is

🚨 A heap-based out-of-bounds write vulnerability in IrfanView's B3D PlugIns could open the door to critical exploitation! 🔥 Think of this like a construction site where the builders accidentally extended a wall too far, risking the entire structure's integrity — one misstep could lead to a catastrophic collapse! If exploited, an attacker could potentially write data to areas of memory they shouldn't have access to, leading to crashes or even execution of malicious code. This could be absolutely devastating, allowing attackers to seize control of your system and wreak havoc!

Put simply

Think of this like a construction site where the builders accidentally extended a wall too far, risking the entire structure's integrity — one misstep could lead to a catastrophic collapse! This vulnerability in B3d.dll (prior to version 4.56) allows for a heap-based out-of-bounds write, which means that an attacker can manipulate memory allocations improperly, potentially leading to arbitrary code execution.

What to do

If exploited, an attacker could potentially write data to areas of memory they shouldn't have access to, leading to crashes or even execution of malicious code. This could be absolutely devastating, allowing attackers to seize control of your system and wreak havoc! Update IrfanView to version 4.56 or later immediately to close this serious vulnerability. Regularly check for updates to ensure you're protected against emerging threats! You've got this! Stay vigilant and patch up like a security superhero! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00562 · 45.9th percentile
Published
2024-01-05T00:00Z
EPSS history
Timeline
  • 05 JAN 00:00Z
    IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write
    cvelistv5