Security readout for executives and security teams
Plain-English summary
This CVE affects XnView Classic for Windows 2.40 when handling crafted FPX image files. A malicious file could crash the application and may have other unspecified effects. The public record does not provide CVSS scoring, a fixed version, or confirmed exploitation.
Executive priority
Treat as a targeted legacy software risk. Prioritize if XnView Classic 2.40 is present in environments that handle external image files; otherwise monitor and remove unsupported exposure during normal hardening.
Technical view
The issue is described as possible stack corruption in Xfpx!gffGetFormatInfo while processing a crafted .fpx file. Reported impact is denial of service or possibly unspecified other impact. The CVE metadata does not identify CWE, CVSS, CPEs, or remediation details.
Likely exposure
Exposure is most likely on Windows endpoints where XnView Classic 2.40 is installed and users open untrusted or externally supplied FPX files.
Exploitation context
The source describes remote attackers using a crafted .fpx file. There is no KEV listing and no cited evidence of active exploitation in the provided bundle.
Researcher notes
Evidence is sparse. The strongest technical clue is stack corruption in the FPX parsing path, but the public bundle does not establish code execution, affected version ranges beyond 2.40, or a fixed release.
Mitigation direction
- Inventory Windows systems for XnView Classic version 2.40.
- Check XnView vendor guidance for fixed versions or supported upgrade paths.
- Restrict opening FPX files from untrusted sources.
- Use sandboxing or isolation for legacy image-file analysis workflows.
- Review endpoint controls for risky file associations.
Validation and detection
- Confirm installed XnView Classic versions on managed Windows endpoints.
- Identify workflows that receive or inspect FPX files.
- Check whether FPX files open by default in XnView Classic.
- Review crash telemetry for Xfpx or gffGetFormatInfo references.
- Track vendor and CVE records for remediation updates.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9907 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/wlinzi/security_advisories/tree/master/CVE-2017-9907CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.