CVE-2020-23887

Name of the Vulnerable Software and Affected Versions: XnView MP version 0.96.4

Description: A heap overflow issue allows attackers to cause a denial of service (DoS) via a crafted ico file, related to a Read Access Violation starting at USER32!SmartStretchDIBits+0x33.

Recommendations: For XnView MP version 0.96.4, consider avoiding the use of crafted ico files until a patch is available. As a temporary workaround, restrict the handling of ico files to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.