CVE-2024-1696: Santesoft Sante FFT Imaging RCE Vulnerability

CVE-2024-1696 Overview

CVE-2024-1696 is an out-of-bounds write vulnerability [CWE-787] in Santesoft Sante FFT Imaging versions 1.4.1 and prior. The flaw is triggered when a user opens a malicious DICOM (.DCM) file with the affected application. A local attacker can leverage the memory corruption to achieve arbitrary code execution in the context of the current user. The issue affects medical imaging workstations and was documented by the Cybersecurity and Infrastructure Security Agency (CISA) in medical advisory ICSMA-24-065-01.

Critical Impact
Successful exploitation allows arbitrary code execution on healthcare imaging workstations through a crafted DICOM file, threatening the confidentiality, integrity, and availability of affected systems.

Affected Products

Santesoft Sante FFT Imaging version 1.4.1
Santesoft Sante FFT Imaging prior versions
Windows-based medical imaging workstations running Sante FFT Imaging

Discovery Timeline

2024-03-11 - CVE-2024-1696 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1696

Vulnerability Analysis

CVE-2024-1696 is an out-of-bounds write in the DICOM file parsing routines of Sante FFT Imaging. The application processes attacker-controlled fields from a .DCM file without adequately validating length or offset values before writing to memory buffers. This condition falls under [CWE-787] Out-of-Bounds Write and enables corruption of adjacent memory structures. An attacker who convinces a user to open a malicious DICOM file can steer the write primitive toward control-flow structures such as function pointers or return addresses. The end result is arbitrary code execution under the privileges of the user running the imaging application. Because medical imaging workstations frequently handle files received from external sources, the user interaction requirement does not meaningfully limit exploitability in clinical environments.

Root Cause

The root cause is insufficient bounds checking when the DICOM parser copies element data into fixed-size destination buffers. Attacker-supplied length or tag values are trusted during parsing, allowing the write operation to exceed allocated memory. This is a common weakness in legacy DICOM parsers that implement the Part 10 file format manually rather than through vetted libraries.

Attack Vector

Exploitation requires local file access and user interaction. An attacker delivers a specially crafted .DCM file via email, shared network storage, removable media, or a compromised Picture Archiving and Communication System (PACS). When the user opens the file in Sante FFT Imaging, the parser processes the malicious structure and triggers the out-of-bounds write.

No public proof-of-concept exploit code is available. The vulnerability mechanism is described in the CISA Medical Advisory ICSMA-24-065-01.

Detection Methods for CVE-2024-1696

Indicators of Compromise

Unexpected crashes of the Sante FFT Imaging process shortly after opening a DICOM file
Creation of child processes (for example cmd.exe, powershell.exe) spawned by the imaging application
Anomalous outbound network connections initiated by the imaging application following file open
Presence of .DCM files sourced from untrusted email attachments or removable media

Detection Strategies

Monitor endpoint telemetry for process-lineage anomalies where the imaging application spawns interpreters or shells
Alert on write access violations and exception events emitted by the Sante FFT Imaging executable
Inspect DICOM files at ingress boundaries for malformed tag lengths and out-of-spec element structures

Monitoring Recommendations

Enable Windows Event Log auditing for application crashes (Event ID 1000) tied to Sante FFT Imaging
Collect and centralize EDR process-creation and file-write events from clinical workstations
Track versions of Sante FFT Imaging deployed across the environment to identify unpatched hosts

How to Mitigate CVE-2024-1696

Immediate Actions Required

Inventory all endpoints running Sante FFT Imaging and identify versions at or below 1.4.1
Upgrade affected installations to a fixed release published by Santesoft after version 1.4.1
Restrict the opening of DICOM files to those sourced from validated PACS and clinical workflows
Educate clinical staff to avoid opening .DCM attachments from unverified senders

Patch Information

Santesoft addresses this issue in versions released after 1.4.1. Administrators should consult the vendor and the CISA Medical Advisory ICSMA-24-065-01 for the current fixed version and download guidance.

Workarounds

Run Sante FFT Imaging under a standard user account rather than an administrative account to limit post-exploitation impact
Segment medical imaging workstations from general-purpose corporate networks and the internet
Block untrusted .DCM file delivery through email gateways and web proxies
Apply application allowlisting to prevent execution of unexpected child processes from the imaging application

bash

# Example: query installed version of Sante FFT Imaging on Windows endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Sante FFT Imaging*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation