XnView ,  is prone to a security vulnerability when processing PCT files. This vulnerability could be exploited by a remote attacker to execute arbitrary code on the target machine, by enticing the user of XnView to open a specially crafted file.
This vulnerability was discovered and researched by Ricardo Narvaja from Core Exploit Writers Team. The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.
As a result, the address 0x41424344 (controlled by the attacker) can be overwritten and the normal execution flow can be altered in order to execute arbitrary code.
2013-07-04: Core Security Technologies notifies the XnView team of the vulnerability. Publication date is set for July 31st, 2013.
2013-07-09: Vendor asks for a report with technical information.
2013-07-10: Technical details sent to XnView team.
2013-07-11: Vendor notifies that the issue will be fixed in the next product release.
2013-07-15: Core asks when the next release has been scheduled.
2013-07-16: Vendor notifies that the next product release is scheduled for next week.
2013-07-17: Core re-schedules the advisory publication for Monday 22nd.