CVE-2024-22100: Microdicom DICOM Viewer Buffer Overflow

CVE-2024-22100 Overview

CVE-2024-22100 is a heap-based buffer overflow vulnerability in MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior. The flaw enables arbitrary code execution when a user opens a maliciously crafted DICOM (.DCM) file. MicroDicom DICOM Viewer is widely used in healthcare environments to display medical imaging data, which makes this a relevant risk for clinical workstations.

Exploitation requires user interaction because the victim must open the malicious file. The vulnerability is tracked under [CWE-122: Heap-based Buffer Overflow] and [CWE-787: Out-of-bounds Write]. Details were coordinated through CISA under advisory ICSMA-24-060-01.

Critical Impact
Successful exploitation allows attackers to execute arbitrary code on clinical imaging workstations, potentially compromising patient data confidentiality, integrity, and availability.

Affected Products

MicroDicom DICOM Viewer 2023.3 (Build 9342)
MicroDicom DICOM Viewer versions prior to 2023.3 (Build 9342)
Windows installations running vulnerable MicroDicom builds

Discovery Timeline

2024-03-01 - CVE-2024-22100 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22100

Vulnerability Analysis

The vulnerability resides in the DICOM file parsing logic of MicroDicom DICOM Viewer. When the application processes a specially crafted .DCM file, the parser writes past the bounds of a heap-allocated buffer. This out-of-bounds write corrupts adjacent heap metadata and object structures, providing attackers a path to hijack control flow.

Because DICOM files contain complex tag-length-value structures with variable-length fields, malformed length descriptors can drive the viewer to allocate a smaller buffer than the data actually written. Attackers can shape the heap layout through repeated tag processing to place attacker-controlled data at predictable offsets. The result is arbitrary code execution in the context of the user running the viewer.

Root Cause

The root cause is insufficient validation of size fields inside DICOM data elements before performing memory copies into heap-allocated buffers. The parser trusts attacker-controlled length values, leading to the [CWE-122] heap overflow and [CWE-787] out-of-bounds write conditions.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious .DCM file through email attachment, removable media, shared network storage, or a compromised PACS (Picture Archiving and Communication System) workflow. When the user opens the file in MicroDicom DICOM Viewer, the overflow triggers and executes attacker-controlled code with the privileges of the logged-in user.

The vulnerability is described in prose because no verified public exploit code is available. For technical details, refer to the CISA Medical Advisory ICSMA-24-060-01.

Detection Methods for CVE-2024-22100

Indicators of Compromise

Unexpected child processes spawned by MicroDicomViewer.exe or related MicroDicom binaries
Crash dumps referencing heap corruption inside DICOM parsing routines
Inbound .DCM files from untrusted email senders, external USB media, or unknown network shares
Outbound network connections initiated by the DICOM viewer process shortly after opening a file

Detection Strategies

Monitor process lineage for MicroDicom Viewer spawning shells, scripting engines, or LOLBins such as powershell.exe, cmd.exe, or rundll32.exe
Alert on writes by the viewer process to autorun locations, Startup folders, or scheduled task registrations
Inspect file provenance for .DCM files opened outside of trusted PACS integrations

Monitoring Recommendations

Enable Windows Defender Exploit Guard or equivalent to log heap corruption crashes for MicroDicom binaries
Forward endpoint telemetry (process creation, file writes, network connections) from clinical workstations to a centralized SIEM for correlation
Track patch state of MicroDicom DICOM Viewer across imaging workstations and flag builds at or below 9342

How to Mitigate CVE-2024-22100

Immediate Actions Required

Upgrade MicroDicom DICOM Viewer to a version later than 2023.3 (Build 9342) on all clinical and administrative workstations
Inventory endpoints running MicroDicom DICOM Viewer and prioritize patching systems that handle externally sourced DICOM files
Instruct clinical staff to avoid opening .DCM files received from untrusted sources or unexpected channels

Patch Information

MicroDicom has released a fixed build addressing this heap overflow. Refer to CISA Medical Advisory ICSMA-24-060-01 for vendor-supplied remediation guidance and download links. Apply the vendor-supplied update through your standard clinical software change management process.

Workarounds

Restrict .DCM file handling to trusted PACS-integrated workflows and block delivery through email or removable media
Run MicroDicom DICOM Viewer under a standard (non-administrator) user account to limit the blast radius of code execution
Apply application allowlisting to prevent MicroDicom binaries from spawning interpreters or unsigned executables
Segment imaging workstations from general-purpose corporate networks to constrain lateral movement following exploitation

bash

# Query installed MicroDicom Viewer version on Windows endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | \
  Where-Object { $_.DisplayName -like "*MicroDicom*" } | \
  Select-Object DisplayName, DisplayVersion, InstallLocation