CVE-2009-4001

Severity: critical (CVSS 9.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2010-03-15 · updated 2026-06-16
Weakness: CWE-189

Description

Integer overflow in XnView before 1.97.2 might allow remote attackers to execute arbitrary code via a DICOM image with crafted dimensions, leading to a heap-based buffer overflow.

Affected products

XnView: through 1.97.1; 1.0-a, 1.01, 1.02, 1.03, 1.04, 1.05 (+91)

References

http://newsgroup.xnview.com/viewtopic.php?f=35&t=19469
http://secunia.com/secunia_research/2009-60/
http://www.osvdb.org/62829
http://www.securityfocus.com/archive/1/509999/100/0/threaded
http://www.securityfocus.com/bid/38629
https://exchange.xforce.ibmcloud.com/vulnerabilities/56802
http://newsgroup.xnview.com/viewtopic.php?f=35&t=19469
http://secunia.com/secunia_research/2009-60/
http://www.osvdb.org/62829
http://www.securityfocus.com/archive/1/509999/100/0/threaded
http://www.securityfocus.com/bid/38629
https://exchange.xforce.ibmcloud.com/vulnerabilities/56802

Get alerted when CVE-2009-4001 or the next vulnerability affects your stack