Security readout for executives and security teams
Plain-English summary
CVE-2017-10747 is a file-parsing flaw in XnView Classic for Windows 2.40. A malicious RLE image file could crash the program or potentially run attacker-controlled code when opened. Business risk is mainly for Windows endpoints that still use this legacy version to handle external image files.
Executive priority
Treat as a targeted legacy endpoint risk, not an enterprise-wide emergency unless XnView Classic 2.40 is still deployed in file-intake workflows. Prioritize discovery and removal or vendor-confirmed upgrade.
Technical view
The CVE describes a crafted .rle file triggering a user-mode write access violation in XnView Classic 2.40 at xnview+0x37a8aa. The public record states possible arbitrary code execution or denial of service, but provides no CVSS, CWE, patch version, or detailed root-cause classification.
Likely exposure
Exposure is likely limited to Windows systems with XnView Classic 2.40 installed, especially where users open RLE files from email, downloads, tickets, or shared storage.
Exploitation context
The source bundle does not show CISA KEV listing or active exploitation. The attack path appears file-based and requires a crafted .rle file to be opened or processed by the vulnerable application.
Researcher notes
Evidence is sparse. The CVE record names XnView Classic 2.40, .rle input, arbitrary code execution or DoS impact, and a write access violation. No patch level, exploit maturity, CVSS vector, or CWE is provided in the bundle.
Mitigation direction
- Inventory Windows endpoints for XnView Classic 2.40.
- Check vendor guidance for fixed or supported XnView versions.
- Remove XnView Classic 2.40 where it is not business-required.
- Avoid opening untrusted .rle files until remediation is confirmed.
- Restrict RLE file handling from email and internet download paths.
Validation and detection
- Confirm whether XnView Classic 2.40 exists in software inventory.
- Check which systems associate .rle files with XnView Classic.
- Review whether users receive or process external image files.
- Verify endpoint controls flag suspicious downloaded or emailed image files.
- Document remediation status and any vendor-supported replacement version.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2017-10747 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-10747CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.