CVE-2024-25578: MicroDicom DICOM Viewer Buffer Overflow Flaw

CVE-2024-25578 Overview

CVE-2024-25578 affects MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior. The application fails to properly validate user-supplied data when processing DICOM (Digital Imaging and Communications in Medicine) files. This lack of validation leads to memory corruption within the application, categorized as an out-of-bounds write [CWE-787]. An attacker can craft a malicious DICOM file that triggers the flaw when opened by a user, potentially resulting in arbitrary code execution in the context of the user running the viewer. CISA published an ICS Medical Advisory tracking the issue given the medical imaging use case.

Critical Impact
A crafted DICOM file processed by a vulnerable MicroDicom DICOM Viewer installation can corrupt memory and lead to arbitrary code execution with the privileges of the current user.

Affected Products

MicroDicom DICOM Viewer 2023.3 (Build 9342)
MicroDicom DICOM Viewer versions prior to 2023.3 (Build 9342)
Windows workstations running vulnerable MicroDicom DICOM Viewer builds

Discovery Timeline

2024-03-01 - CVE-2024-25578 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25578

Vulnerability Analysis

MicroDicom DICOM Viewer parses DICOM files that combine imaging data with rich metadata tags. The vulnerable code paths accept attacker-controlled fields without enforcing size or type bounds. When the viewer processes a crafted file, it writes data past the end of an allocated buffer, corrupting adjacent memory. The condition maps to [CWE-787] Out-of-bounds Write.

Exploitation requires user interaction. A victim must open the malicious DICOM file inside the vulnerable viewer, for example after receiving it by email, downloading it from a shared drive, or importing it from removable media. The attack executes locally in the security context of the user.

Successful exploitation can overwrite function pointers, return addresses, or object metadata used later by the process. This enables arbitrary code execution with the privileges of the current user and full impact on confidentiality, integrity, and availability of the workstation. In clinical environments, the compromised host may hold PHI (Protected Health Information) and connect to PACS (Picture Archiving and Communication System) infrastructure.

Root Cause

The root cause is missing validation of user-supplied fields within DICOM file structures. The parser copies or interprets attacker-controlled sizes and offsets before confirming they fit target buffers, allowing writes beyond allocated memory.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious .dcm file and convinces a user to open it in the affected MicroDicom DICOM Viewer. No authentication is required on the target system.

No verified public proof-of-concept code is available. See the CISA ICS Medical Advisory for vendor-coordinated technical details.

Detection Methods for CVE-2024-25578

Indicators of Compromise

Unexpected crashes of MicroDicom.exe or related processes shortly after a DICOM file is opened.
DICOM files arriving from untrusted email senders, external USB media, or non-clinical file shares.
Child processes spawned by the DICOM Viewer that are not associated with normal imaging workflows, such as cmd.exe, powershell.exe, or script interpreters.
Outbound network connections initiated by the viewer process to non-PACS destinations.

Detection Strategies

Inventory endpoints for installed MicroDicom DICOM Viewer builds and flag versions at or below 2023.3 (Build 9342).
Enable endpoint telemetry that records process creation, module loads, and exception events for the viewer.
Alert on crash events (Windows Error Reporting, WerFault.exe) tied to the viewer executable, which may indicate exploitation attempts.
Inspect email gateways and file shares for .dcm attachments originating outside expected clinical partners.

Monitoring Recommendations

Correlate viewer crashes with recently opened files to identify candidate malicious DICOM samples for analysis.
Monitor for anomalous child processes or memory-injection patterns from the viewer using EDR behavioral rules.
Track user-mode exceptions such as access violations on write operations within the viewer process.
Log and review any lateral movement or credential access attempts from workstations used to open unverified DICOM files.

How to Mitigate CVE-2024-25578

Immediate Actions Required

Upgrade MicroDicom DICOM Viewer to the fixed release published after 2023.3 (Build 9342) as referenced in the CISA advisory.
Restrict opening of DICOM files to trusted sources such as authenticated PACS exports and vetted clinical partners.
Remove or restrict local administrator rights on workstations that run the viewer to limit blast radius after exploitation.
Educate clinical users to avoid opening unsolicited .dcm attachments or files from removable media.

Patch Information

MicroDicom released a fixed version addressing the improper input validation issue. Refer to the CISA ICS Medical Advisory ICSMA-24-060-01 for the vendor-recommended fixed build and update instructions. Apply the update to all workstations identified during inventory.

Workarounds

Block inbound .dcm attachments at email gateways unless originating from authenticated clinical senders.
Segment imaging workstations from general-purpose corporate networks to reduce exposure of untrusted files.
Enforce application allowlisting so that unexpected child processes spawned by the viewer are prevented from executing.
Enable exploit mitigations such as DEP, ASLR, and Control Flow Guard on hosts running the viewer.

bash

# Example: query installed MicroDicom DICOM Viewer version on Windows
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "MicroDicom"

# Example: block .dcm attachments from external senders in Exchange transport rule (PowerShell)
New-TransportRule -Name "Block External DICOM Attachments" \
  -FromScope NotInOrganization \
  -AttachmentExtensionMatchesWords "dcm" \
  -RejectMessageReasonText "External DICOM files must be delivered via PACS."