Buffer overflow in IrfanView before 4.37 when a multibyte-character directory name is used allows user-assisted remote attackers to execute arbitrary code via a crafted file that is incorrectly handled by the Thumbnail tooltips feature in the Thumbnails window.