Read the docs
TI-2013-03441 Aliases CVE-2013-3939GHSA-wfq4-7r76-pfcq

Out-of-bounds write in XnView

Priority LOW 38CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers to execute arbitrary code via the RLE strip size field in a RGB file, which leads to an unexpected sign extension error and a heap-based buffer overflow.

Why it matters now

EPSS 0.01726 77th percentileScored 2026-11-07
Fix Fixed XnView (XnView): 2.13

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
XnViewXnViewbefore 2.132.13Patch availableCNA
  • XnView VendorXnView Affected before 2.13 Fixed in 2.13 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:xnview:xnview:*:*:*:*:*:*:*:*before 2.13VulnerableXnView
  • cpe:2.3:a:xnview:xnview:*:*:*:*:*:*:*:* Versions before 2.13 Vulnerable ·XnView

Remediation

  • Fix · CNA XnView (XnView) Fixed in 2.13

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-3939
  2. 2026-10-03 Alias added: GHSA-wfq4-7r76-pfcq

References

Advisory 1

  • TI-2013-02281 Buffer overflow in XnView before 2.04 allows remote attackers to execute arbitrary code via a crafted PCT file. CVSS 2.0HIGH 9.3
  • TI-2010-01850 Heap-based buffer overflow in XnView 1.97.4 and possibly earlier allows remote attackers… CVSS 2.0HIGH 9.3
  • TI-2012-04214 Heap-based buffer overflow in the xjpegls.dll (aka JLS, JPEG-LS, or JPEG lossless) format… CVSS 2.0HIGH 9.3
  • TI-2009-03793 Integer overflow in XnView before 1.97.2 might allow remote attackers to execute… CVSS 2.0HIGH 9.3
  • TI-2013-03443 Out-of-bounds write in XnView CVSS 3.1CRITICAL 9.8
  • TI-2008-01398 Buffer overflow in XnView 1.92.1 allows user-assisted remote attackers to execute… CVSS 2.0HIGH 7.6
See all 155 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences