CVE-2024-1453: Santesoft Dicom Viewer Pro RCE Vulnerability

CVE-2024-1453 Overview

CVE-2024-1453 is an out-of-bounds read vulnerability [CWE-125] in Sante DICOM Viewer Pro versions 14.0.3 and prior. The flaw affects how the application parses Digital Imaging and Communications in Medicine (DICOM) files. An attacker crafts a malicious DICOM file and convinces a local user to open it in the vulnerable viewer. Successful exploitation allows the attacker to disclose sensitive memory contents or execute arbitrary code in the context of the user. The vulnerability primarily impacts healthcare environments where DICOM viewers process medical imaging data from external sources.

Critical Impact
A specially crafted DICOM file opened by a local user can lead to information disclosure or arbitrary code execution on the host workstation.

Affected Products

Santesoft Sante DICOM Viewer Pro 14.0.3
Santesoft Sante DICOM Viewer Pro prior versions to 14.0.3
Deployments in healthcare imaging environments processing external DICOM files

Discovery Timeline

2024-03-01 - CVE-2024-1453 published to NVD
2024-02-27 - CISA publishes Medical Advisory ICSMA-24-058-01
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1453

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in the DICOM file parser of Sante DICOM Viewer Pro. DICOM files contain structured tag-value pairs with length fields describing embedded pixel data, metadata, and sequences. When the parser processes a malformed length or offset field, it reads memory beyond the allocated buffer boundary. This condition can leak adjacent process memory to attacker-controlled structures or corrupt program state sufficient to redirect execution flow. The advisory published as CISA ICSMA-24-058-01 confirms that successful exploitation allows both information disclosure and arbitrary code execution.

Root Cause

The root cause is insufficient boundary validation when the parser dereferences DICOM data element lengths and offsets. The application trusts attacker-controlled size fields when reading structured content, allowing reads past the end of allocated buffers.

Attack Vector

Exploitation requires local access with user interaction. The victim must open a malicious DICOM file, typically delivered by email, removable media, PACS import, or a shared imaging archive. No privileges are required beyond the ability to launch the viewer as the current user. Impact scope remains within the user context but yields high confidentiality, integrity, and availability impact.

No public proof-of-concept code has been released for this vulnerability. Refer to the CISA Medical Advisory ICSMA-24-058-01 for vendor coordination details.

Detection Methods for CVE-2024-1453

Indicators of Compromise

Unexpected crashes or exception dialogs from SanteDICOMViewerPro.exe shortly after opening a .dcm file
DICOM files originating from untrusted sources (email attachments, USB media, external portals) staged on radiologist or clinician workstations
Child processes spawned by the DICOM viewer that do not match imaging workflow behavior, such as cmd.exe, powershell.exe, or rundll32.exe
Outbound network connections from the viewer process to non-PACS destinations

Detection Strategies

Monitor endpoint telemetry for anomalous child process creation under the Sante DICOM Viewer Pro parent process
Alert on module loads or memory allocations with executable permissions inside the viewer process after loading a DICOM file
Use file integrity monitoring to flag .dcm files written to user download or temporary directories from external sources
Correlate application crashes with DICOM file open events using Windows Event Log ID 1000 filtered by the viewer executable

Monitoring Recommendations

Enable Windows Defender Exploit Guard or an equivalent exploit mitigation and log blocked events on clinical workstations
Ingest workstation process, file, and network telemetry into a central SIEM for retention and hunting
Track version inventory for dicom_viewer_pro across all endpoints to identify vulnerable installations

How to Mitigate CVE-2024-1453

Immediate Actions Required

Upgrade Sante DICOM Viewer Pro to a version later than 14.0.3 as directed by Santesoft
Restrict opening of DICOM files to trusted internal PACS sources until patching is complete
Educate clinical staff on the risk of opening DICOM attachments from unsolicited email or removable media
Isolate legacy imaging workstations that cannot be updated on segmented VLANs with restricted internet access

Patch Information

Santesoft addresses the issue in versions released after 14.0.3. Consult the CISA Medical Advisory ICSMA-24-058-01 for the vendor-supplied fixed version and download guidance. Verify installer authenticity using vendor-provided signatures before deployment.

Workarounds

Block execution of Sante DICOM Viewer Pro on workstations that do not require it using application allowlisting
Route inbound DICOM files through a sanitization or transcoding gateway before delivery to viewer workstations
Apply least-privilege user accounts so exploitation is contained within a non-administrative context
Disable auto-open handlers for the .dcm file extension in email clients and file managers

bash

# Windows AppLocker example: block Sante DICOM Viewer Pro until patched
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny \
  -Path "%ProgramFiles%\Santesoft\Sante DICOM Viewer Pro\SanteDICOMViewerPro.exe"