CVE-2025-2480: Santesoft Dicom Viewer Pro RCE Vulnerability

CVE-2025-2480 Overview

CVE-2025-2480 is an out-of-bounds write vulnerability [CWE-787] in Santesoft Sante DICOM Viewer Pro, a medical imaging application used to view Digital Imaging and Communications in Medicine (DICOM) files. A local attacker can craft a malicious .DCM file that, when opened by a user, triggers memory corruption and arbitrary code execution. The flaw carries a CVSS v4.0 score of 8.4 and was published to the National Vulnerability Database (NVD) on March 20, 2025. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued medical advisory ICSMA-25-079-01 covering this issue.

Critical Impact
Successful exploitation results in arbitrary code execution in the context of the user opening the malicious DICOM file, potentially exposing protected health information and clinical workflows on healthcare workstations.

Affected Products

Santesoft Sante DICOM Viewer Pro (versions prior to the vendor patch)
Windows installations of Sante DICOM Viewer Pro
Healthcare workstations processing untrusted .DCM files

Discovery Timeline

2025-03-20 - CVE-2025-2480 published to NVD
2025-10-16 - Last updated in NVD database

Technical Details for CVE-2025-2480

Vulnerability Analysis

The vulnerability is an out-of-bounds write in the DICOM file parser of Sante DICOM Viewer Pro. When the application processes a malformed .DCM file, it writes data past the end of an allocated buffer. This corrupts adjacent memory structures and allows an attacker to influence program control flow. Because DICOM files use a complex tag-based encoding with multiple value representations and embedded pixel data, parser logic must validate length fields against actual buffer capacity. The flaw indicates that one or more length checks are missing or incorrect.

Exploitation requires user interaction. A clinician or technician must open the malicious file in the viewer, either from local media, a Picture Archiving and Communication System (PACS) export, or an email attachment. The attack vector is Local with low attack complexity and no privileges required beyond the ability to deliver the file.

Root Cause

The root cause is improper validation of length or offset values during DICOM data set parsing, classified under CWE-787 (Out-of-bounds Write). Attacker-controlled fields in the file header or tag stream cause the parser to write past a heap or stack buffer boundary, corrupting memory used by the application.

Attack Vector

The attack requires local delivery of a crafted .DCM file and active user interaction to open it. Delivery channels include phishing emails with DICOM attachments, malicious USB media at imaging workstations, compromised PACS exports, and DICOM files retrieved from untrusted sources. No authentication is required on the target system.

No public proof-of-concept exploit code is available. The vulnerability is described in prose only; refer to the CISA Medical Advisory ICSMA-25-079-01 for vendor-coordinated details.

Detection Methods for CVE-2025-2480

Indicators of Compromise

Unexpected crashes or abnormal termination of Sante DICOM Viewer Pro.exe when opening .DCM files
Child processes spawned by the DICOM viewer that are not part of normal imaging workflows (for example, cmd.exe, powershell.exe, or unsigned binaries)
Outbound network connections initiated by the viewer process to unfamiliar hosts after opening a DICOM file
.DCM files originating from email attachments, removable media, or external download paths rather than internal PACS systems

Detection Strategies

Monitor process creation events where the parent is the Sante DICOM Viewer Pro binary and the child is a shell, scripting host, or unsigned executable.
Alert on memory access violations and Windows Error Reporting (WER) crash events tied to the viewer binary.
Inspect file write and modification events targeting .DCM files in non-standard directories such as user Downloads, Desktop, or temporary folders.

Monitoring Recommendations

Enable endpoint logging for process creation, image loads, and module injection events on workstations running the viewer.
Aggregate DICOM file telemetry, including hash, source, and originating user, into a centralized log platform for retrospective hunting.
Track patch state of Sante DICOM Viewer Pro across all clinical endpoints using software inventory tools.

How to Mitigate CVE-2025-2480

Immediate Actions Required

Update Sante DICOM Viewer Pro to the latest version available from the Santesoft download page.
Restrict execution of the viewer to operators who handle vetted DICOM sources only.
Block .DCM attachments from external email until patching is verified across all endpoints.
Review CISA advisory ICSMA-25-079-01 for vendor-supplied remediation guidance.

Patch Information

Santesoft has released a fixed version of Sante DICOM Viewer Pro. Administrators should download the current build from the vendor and deploy it to all affected workstations. Confirm the installed version after deployment and remove older installers from software distribution shares.

Workarounds

Do not open .DCM files received from untrusted or unverified sources.
Open DICOM files only from internal PACS systems and validated clinical workflows.
Apply application allowlisting to prevent unsigned child processes from launching under the viewer.
Run the viewer under a standard user account with no administrative privileges to limit post-exploitation impact.

bash

# Verify installed version of Sante DICOM Viewer Pro on Windows
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" `
  | Where-Object { $_.DisplayName -like "*Sante DICOM Viewer Pro*" } `
  | Select-Object DisplayName, DisplayVersion, Publisher, InstallLocation