Security readout for executives and security teams
Plain-English summary
This issue affects XnView Classic for Windows 2.40 when handling a crafted .fpx image file. The documented impact is application denial of service, with possible unspecified additional impact. The sources do not provide CVSS, a confirmed patch, or evidence of active exploitation.
Executive priority
Prioritize as legacy desktop software risk, not an internet-wide emergency. Act faster if exposed users handle external image files, legal discovery materials, media submissions, or customer-supplied content.
Technical view
The CVE describes a crafted FPX file triggering a crash condition tied to heap-free behavior in Windows ntdll, where faulting-address data influences branch selection. The record does not establish code execution, affected versions beyond XnView Classic 2.40, or a vendor-fixed release.
Likely exposure
Exposure is likely limited to Windows endpoints where XnView Classic 2.40 is installed and users open untrusted .fpx files. No server-side exposure is described in the provided sources.
Exploitation context
A remote attacker would need to deliver a crafted .fpx file that is opened or processed by the vulnerable application. CISA KEV status is false, and the provided sources do not claim active exploitation.
Researcher notes
The public record is sparse. It identifies a vulnerable application version and crafted FPX trigger, but lacks CVSS, CWE, complete affected product metadata, vendor remediation details, and confirmed exploit status. Treat impact beyond denial of service as unproven.
Mitigation direction
- Inventory systems for XnView Classic for Windows 2.40.
- Check XnView vendor guidance for fixed versions or replacement recommendations.
- Block or quarantine untrusted .fpx attachments where business use is unnecessary.
- Discourage opening FPX files from unknown or external sources.
- Use endpoint controls to limit legacy image viewers on sensitive workstations.
Validation and detection
- Confirm whether XnView Classic 2.40 is installed on managed Windows endpoints.
- Review file associations for .fpx files on affected workstations.
- Check email and web controls for inbound .fpx handling.
- Review endpoint crash telemetry involving XnView and FPX files.
- Document any business process that still requires FPX file viewing.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9904 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9904CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.