Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-107125: XnView Classic may let attackers take control
CVE-2026-107125 · published 11 days ago
Summary
XnView Classic version 2.52.5 has a flaw in the part that reads FLI video files. A specially crafted file can cause the program to run out of memory and allow a remote attacker to execute their own code. Updating to version 2.52.6 fixes the problem, so apply the update as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| xnview | classic | 2.52.5 |
Original advisory text
XnView Classic FLI File heap-based overflow
A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
2.1
Low
Type
CWE-122Heap-based Buffer Overflow
CWE-119Buffer Overflow
Timeline
Published7 Oct 2026
Updated15 Oct 2026
First seen7 Oct 2026
Track software like this
Free during beta