Vulnerability · Published Oct 7, 2026 · Assigned by VulDB
CVE-2026-107125XnView Classic FLI File heap-based overflow
Medium 6.3
In plain English
A medium-severity heap buffer overflow in Classic from XnView. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 75.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
A flaw has been found in XnView Classic 2.52.5. Impacted is an unknown function of the component FLI File Parser. This manipulation of the argument starting_line causes heap-based buffer overflow. Remote exploitation of the attack is possible. Upgrading to version 2.52.6 is recommended to address this issue. Upgrading the affected component is advised.
Affected products (as reported)
Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
References
- VDB-414926 | XnView Classic FLI File heap-based overflow vdb-entry, technical-description
- VDB-414926 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-107125 | CVE Analysis and Report third-party-advisory
- Submit #993948 | XnSoft XnView 2.52.5.0 Heap Buffer Overflow Remote Code Execution third-party-advisory
- https://newsgroup.xnview.com/viewtopic.php?t=51359 related
- https://www.xnview.com/en/xnview/#downloads patch