CVE-2024-28877: Microdicom DICOM Viewer Buffer Overflow

CVE-2024-28877 Overview

MicroDicom DICOM Viewer contains a stack-based buffer overflow vulnerability that allows attackers to execute arbitrary code on affected installations. The flaw exists in the parsing logic used by the application to process Digital Imaging and Communications in Medicine (DICOM) files. Exploitation requires user interaction, typically opening a malicious DICOM file or visiting an attacker-controlled resource. The vulnerability affects medical imaging workflows where DICOM files are routinely exchanged between systems and practitioners. CISA published Medical Advisory ICSMA-24-163-01 documenting the issue and its impact on healthcare environments.

Critical Impact
Attackers can achieve arbitrary code execution on a clinician's workstation when a crafted DICOM file is opened, compromising confidentiality, integrity, and availability of the host.

Affected Products

MicroDicom DICOM Viewer (all versions prior to the vendor-issued fix)
Workstations running the affected viewer in healthcare and research settings
Systems processing DICOM files received from external sources

Discovery Timeline

2024-06-11 - CVE-2024-28877 published to NVD
2024-06-11 - CISA Medical Advisory ICSMA-24-163-01 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28877

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow classified under [CWE-121] and [CWE-787] (out-of-bounds write). MicroDicom DICOM Viewer fails to validate the length of attacker-controlled data before copying it into a fixed-size stack buffer during DICOM file processing. When the supplied data exceeds the buffer size, adjacent stack memory is overwritten, including the saved return address and structured exception handlers.

An attacker who controls the overwritten control data can redirect execution to attacker-supplied shellcode or chain return-oriented programming gadgets. Because the viewer runs in the user's security context, successful exploitation grants the attacker the privileges of the logged-in user. This is particularly concerning in healthcare environments where the same workstation may access electronic health records and Picture Archiving and Communication Systems (PACS).

Root Cause

The root cause is missing bounds checking on length fields parsed from untrusted DICOM input before they drive memory copy operations into stack buffers. The DICOM format uses tag-length-value structures, and an oversized length field causes the copy routine to write beyond the destination buffer.

Attack Vector

The attack vector is network-adjacent but user-assisted. An attacker delivers a malicious .dcm file via email, web download, removable media, or a shared imaging repository. When the victim opens the file in MicroDicom DICOM Viewer, the malformed DICOM element triggers the overflow and executes the attacker's payload. No authentication is required, and exploitation succeeds on default installations.

No verified public exploit code is available at this time. Refer to the CISA Medical Advisory ICSMA-24-163-01 for additional technical context.

Detection Methods for CVE-2024-28877

Indicators of Compromise

Unexpected child processes spawned by the MicroDicom DICOM Viewer executable, such as cmd.exe, powershell.exe, or rundll32.exe.
Crashes or Windows Error Reporting events referencing the viewer process shortly after a DICOM file is opened.
DICOM files originating from untrusted email senders, web downloads, or removable media that bypass normal clinical workflows.
Outbound network connections from the viewer process to unfamiliar external hosts following file open events.

Detection Strategies

Monitor process creation events where the parent process is the MicroDicom viewer and the child is a scripting interpreter or living-off-the-land binary.
Inspect DICOM files for malformed tag-length-value structures using DICOM parsers configured in strict validation mode.
Deploy memory-corruption identification through behavioral analytics that flag stack pivots and unexpected control flow in user-mode applications.
Correlate file open telemetry with subsequent anomalous module loads inside the viewer process.

Monitoring Recommendations

Log file open events for .dcm extensions and forward them to a central analytics platform for correlation with downstream process activity.
Track inbound DICOM files arriving over email, web, or removable media on clinical workstations.
Enable Windows Defender Exploit Guard or equivalent telemetry to capture exploit attempts against the viewer.
Alert on viewer process crashes that recur across multiple endpoints, indicating possible exploit attempts or campaign activity.

How to Mitigate CVE-2024-28877

Immediate Actions Required

Update MicroDicom DICOM Viewer to the latest vendor-supplied version that addresses CVE-2024-28877.
Restrict opening of DICOM files to those originating from trusted PACS systems and verified clinical partners.
Train clinical staff to avoid opening unsolicited DICOM attachments delivered via email or external links.
Apply application allowlisting to limit which processes can be launched by the viewer.

Patch Information

MicroDicom has released a fixed version of DICOM Viewer that addresses the stack-based buffer overflow. Refer to the CISA Medical Advisory ICSMA-24-163-01 for vendor remediation guidance and the specific fixed version number. Apply the update across all clinical workstations and imaging review stations as a priority.

Workarounds

Operate the viewer under a standard user account with no local administrator rights to limit post-exploitation impact.
Enable Windows exploit mitigations such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) for the viewer process.
Use endpoint isolation or application sandboxing to contain the viewer when handling DICOM files from external sources.
Block inbound DICOM files at email and web gateways until patching is complete on affected systems.

bash

# Configuration example: enforce exploit mitigations for the viewer via PowerShell
Set-ProcessMitigation -Name "MicroDicomViewer.exe" -Enable DEP,SEHOP,ForceRelocateImages,BottomUp,HighEntropy,CFG