XnView Classic 2.48 has a User Mode Write AV starting at xnview+0x0000000000327464.Referenceshttps://github.com/apriorit/pentesting/blob/master/bugs/xnview/0x0000000000327464.md
