CVE-2013-3939

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-01-02 · updated 2026-06-16
Weakness: CWE-787

Description

xnview.exe in XnView before 2.13 does not properly handle RLE strip lengths during processing of RGB files, which allows remote attackers to execute arbitrary code via the RLE strip size field in a RGB file, which leads to an unexpected sign extension error and a heap-based buffer overflow.

Affected products

XnView: before 2.13 — fixed in 2.13

How to fix

Upgrade to a fixed version: XnView 2.13. Check the vendor advisory for mitigations.

References

http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087
http://secunia.com/advisories/52101
http://newsgroup.xnview.com/viewtopic.php?f=35&t=29087
http://secunia.com/advisories/52101

Get alerted when CVE-2013-3939 or the next vulnerability affects your stack