CVE-2026-121517
IrfanView TIFF Wang Annotation heap-based overflow
CVSS Score
5.0
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was detected in IrfanView 4.76.0.0 on Win64. Affected by this vulnerability is an unknown functionality of the component TIFF Wang Annotation Handler. Performing a manipulation results in heap-based buffer overflow. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit is now public and may be used. It is recommended to apply a patch to fix this issue. The vendor confirms: "[T]he TIF-Annotations option is OFF by default. Means, normal users are not affected ... the danger level for this is low".
| CWE | CWE-122 CWE-119 |
| Vendor | n/a |
| Product | irfanview |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a irfanview
Be the first to know when new medium vulnerabilities affecting n/a irfanview are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
n/a / IrfanView
4.76.0.0
References
vuldb.com: https://vuldb.com/vuln/430288 vuldb.com: https://vuldb.com/vuln/430288/cti vuldb.com: https://vuldb.com/cve/CVE-2026-121517 vuldb.com: https://vuldb.com/submit/1018543 github.com: https://github.com/dwBruijn/CVEs/blob/main/IrfanView/TIFF/Tiff_Wang.md irfanview.com: https://www.irfanview.com/
Credits
🔍 dwbruijn (VulDB User) VulDB CNA Team