CVE-2025-31946: Pixmeo OsiriX MD Use After Free Vulnerability

CVE-2025-31946 Overview

CVE-2025-31946 is a local use-after-free vulnerability in Pixmeo OsiriX MD, a medical imaging application used for viewing Digital Imaging and Communications in Medicine (DICOM) files. An attacker with local access can import a crafted DICOM file to trigger memory corruption or a system crash. The flaw is tracked under [CWE-416: Use After Free] and was published in the National Vulnerability Database (NVD) on May 8, 2025. CISA issued Medical Advisory ICSMA-25-128-01 covering the issue.

Critical Impact
A locally imported malicious DICOM file can corrupt memory or crash the OsiriX MD application, disrupting clinical imaging workflows.

Affected Products

Pixmeo OsiriX MD (medical imaging DICOM viewer)
macOS deployments running vulnerable OsiriX MD builds
Clinical workstations that import third-party DICOM files

Discovery Timeline

2025-05-08 - CVE-2025-31946 published to NVD
2025-05-08 - CISA published Medical Advisory ICSMA-25-128-01
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31946

Vulnerability Analysis

OsiriX MD parses DICOM files during import, allocating and releasing memory objects that represent image metadata and pixel data. The vulnerability occurs when the application continues to reference a memory region after it has been freed. An attacker who supplies a specially crafted DICOM file can steer the parser into this state, producing undefined behavior.

The consequences include heap corruption and application termination. In medical environments, an unexpected crash of the imaging viewer interrupts diagnostic workflows and may lead to loss of unsaved annotations or measurements. The vulnerability affects availability but does not compromise confidentiality or integrity of clinical data according to the published scoring vector.

Exploitation requires local access to the workstation and the ability to place a DICOM file into a location the operator will open. No authentication or user interaction beyond normal file import is required by the vulnerable code path.

Root Cause

The root cause is improper lifecycle management of a heap-allocated object during DICOM parsing, classified as [CWE-416]. The application dereferences a pointer to memory that has already been released, resulting in use-after-free behavior when specific DICOM tag combinations are processed.

Attack Vector

The attack vector is local. An adversary delivers a malicious DICOM file to a workstation running OsiriX MD through removable media, email attachments, network shares, or Picture Archiving and Communication System (PACS) transfers. When a clinician or technician imports the file, the malformed structure triggers the use-after-free condition and crashes the viewer.

No verified public proof-of-concept exploit code is available for this vulnerability. Refer to CISA Medical Advisory ICSMA-25-128-01 for technical details published by the coordinating authority.

Detection Methods for CVE-2025-31946

Indicators of Compromise

Unexpected termination or hang of the OsiriX MD process shortly after importing a DICOM file
Crash reports referencing the OsiriX MD binary with signatures consistent with heap corruption
DICOM files originating from untrusted senders or with malformed tag structures

Detection Strategies

Monitor macOS crash logs under ~/Library/Logs/DiagnosticReports/ for entries naming the OsiriX MD process
Alert on repeated OsiriX MD process crashes across clinical endpoints within short time windows
Inspect inbound DICOM files with parsers that validate structure before delivery to imaging workstations

Monitoring Recommendations

Enable endpoint telemetry to capture process termination events and associated file access on imaging workstations
Track the provenance of DICOM files entering the environment, particularly those from external referrals
Correlate crash events with the specific DICOM file most recently opened by the user session

How to Mitigate CVE-2025-31946

Immediate Actions Required

Restrict DICOM file imports to trusted sources such as authenticated PACS nodes and vetted modality workstations
Contact Pixmeo through the OsiriX contact page to obtain the current patched build
Limit interactive access to workstations running OsiriX MD to authorized clinical staff only

Patch Information

Refer to CISA Medical Advisory ICSMA-25-128-01 and the OsiriX MD product page for vendor guidance on remediated versions. Apply the vendor-supplied update to all clinical workstations running OsiriX MD.

Workarounds

Do not open DICOM files received from untrusted or unverified sources on OsiriX MD workstations
Route inbound DICOM traffic through a validating gateway that enforces DICOM conformance before forwarding to viewers
Apply the principle of least privilege on macOS accounts used for clinical imaging to limit blast radius from a crash or memory corruption event

bash

# Configuration example: quarantine inbound DICOM files for validation
# before delivery to the OsiriX MD import directory
mkdir -p /var/dicom/inbound /var/dicom/quarantine /var/dicom/validated
chmod 750 /var/dicom/quarantine
# Run a DICOM conformance validator (e.g., dciodvfy from dicom3tools)
# against each file before promoting it to the validated directory
for f in /var/dicom/inbound/*.dcm; do
    dciodvfy "$f" > "/var/dicom/quarantine/$(basename "$f").log" 2>&1 \
        && mv "$f" /var/dicom/validated/ \
        || mv "$f" /var/dicom/quarantine/
done