XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000384e2a.Referenceshttps://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x384e2a.md