Read the docs
TI-2026-69158 Aliases CVE-2026-107125GHSA-6qwg-pvpq-p453

Heap-based buffer overflow in XnView Classic FLI file parser

Priority MEDIUM 57CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

XnView Classic from 2.52.5 is affected. A flaw in the FLI file parser lets the starting_line argument cause a heap-based buffer overflow (CWE-122). A remote attacker can trigger it if a user opens a crafted FLI file.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed Classic (XnView): 2.52.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
XnViewClassic2.52.52.52.6Patch availableCNA
  • Classic VendorXnView Affected 2.52.5 Fixed in 2.52.6 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:xnview:classic:*:*:*:*:*:*:*:*——XnView
  • cpe:2.3:a:xnview:classic:*:*:*:*:*:*:*:* Versions — — ·XnView

Remediation

Upgrade XnView Classic to version 2.52.6.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA Classic (XnView) Fixed in 2.52.6

Timeline

  1. 2026-10-07 Threatist record created from CVE-2026-107125
  2. 2026-10-07 Alias added: GHSA-6qwg-pvpq-p453
  3. 2026-10-07 CISA SSVC decision points changed
  4. 2026-10-07 Priority changed: LOW → MEDIUM

References

Patch 1

Other 1

  • TI-2023-28601 XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3ADBD0. CVSS 3.1CRITICAL 9.8
  • TI-2023-23157 XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow via a crafted image file. CVSS 3.1HIGH 7.8
  • TI-2023-23156 XNSoft Nconvert 7.136 has an Exception Handler Chain Corrupted via a crafted image file. CVSS 3.1HIGH 7.8
  • TI-2024-15054 Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers… CVSS 3.1MEDIUM 6.5
  • TI-2026-23418 XnSoft NConvert 7.230 is vulnerable to Use-After-Free via a crafted .tiff file CVSS 3.1MEDIUM 6.2
  • TI-2026-23417 XnSoft NConvert 7.230 is vulnerable to Stack Buffer Overrun via a crafted .tiff file. CVSS 3.1MEDIUM 6.2
See all 174 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences