CVE-2025-3482: MedDream PACS Server RCE Vulnerability

CVE-2025-3482 Overview

CVE-2025-3482 is a stack-based buffer overflow [CWE-121] in MedDream PACS Server that enables arbitrary code execution through malicious DICOM (Digital Imaging and Communications in Medicine) files. The flaw exists in the DICOM file parsing routine, which fails to validate the length of user-supplied data before copying it into a fixed-length stack buffer. An attacker can leverage this condition to execute code in the context of the service account running the PACS application. The vulnerability was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-25826.

Critical Impact
Successful exploitation grants code execution within the MedDream PACS service account, exposing patient imaging data and providing a foothold inside clinical networks.

Affected Products

MedDream PACS Server (Premium edition)
Installations parsing untrusted DICOM files
Healthcare environments running unpatched MedDream PACS deployments

Discovery Timeline

2025-05-22 - CVE-2025-3482 published to the National Vulnerability Database
2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-3482

Vulnerability Analysis

The vulnerability resides in the DICOM file parsing logic of MedDream PACS Server. DICOM is the standard format for medical imaging data, containing structured tags that describe patient images and metadata. When the server processes a crafted DICOM file, it copies attacker-controlled data into a fixed-size stack buffer without first validating the source length.

Because the destination buffer lives on the stack, an oversized field overwrites adjacent stack memory, including saved return addresses and frame pointers. An attacker who controls the overflow can redirect execution to attacker-supplied shellcode or chain return-oriented programming gadgets. The code then runs with the privileges of the PACS service account, which in clinical environments typically has access to image archives and connected modalities.

While the CVSS attack vector is rated as local and requires user interaction to load the malicious file, PACS workflows routinely accept DICOM uploads from imaging modalities, referring physicians, and external study transfers. This expands the realistic exploitation surface.

Root Cause

The root cause is missing bounds validation on a user-controlled length field before invoking a memory copy into a stack-allocated buffer. The parser trusts the size of an embedded DICOM element rather than enforcing the destination capacity, producing a classic stack-based buffer overflow.

Attack Vector

An attacker delivers a malformed DICOM file to the PACS server through any ingestion path that the server processes. This includes manual study imports, automated modality transfers, or referrals from outside institutions. Authentication is not required for the parsing flaw itself, though a user must trigger the file load. Successful exploitation yields arbitrary code execution as the PACS service account.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.675% as of the latest scoring.

For additional technical context, see the Zero Day Initiative Advisory ZDI-25-244.

Detection Methods for CVE-2025-3482

Indicators of Compromise

Unexpected child processes spawned by the MedDream PACS service binary, particularly command interpreters such as cmd.exe, powershell.exe, or /bin/sh.
Crash events or abnormal terminations in the PACS service logs coinciding with DICOM ingest activity.
DICOM files of anomalous size or containing elements with implausibly large length fields in the study intake directory.
Outbound network connections from the PACS service account to non-clinical destinations.

Detection Strategies

Hunt for process-tree anomalies where the PACS service spawns scripting hosts, network utilities, or LOLBins.
Inspect DICOM ingest queues for files with malformed or oversized tag lengths using DICOM validation tooling.
Correlate PACS process crashes with subsequent service restarts and inbound file transfers from the same source.

Monitoring Recommendations

Enable EDR file and process telemetry on PACS hosts and forward to a centralized SIEM with alerting on service account misuse.
Monitor network egress from PACS servers and alert on connections that fall outside the documented modality and HIS/RIS communication map.
Track authentication and service-account activity for the PACS service to detect post-exploitation lateral movement.

How to Mitigate CVE-2025-3482

Immediate Actions Required

Identify all MedDream PACS Server instances, including Premium edition deployments, and confirm patch status against the vendor advisory.
Restrict DICOM ingest to authenticated, allow-listed modality and referrer sources.
Run the PACS service under a least-privilege account with no interactive logon rights and no domain administrator membership.
Segment PACS hosts on a dedicated VLAN with strict egress filtering to limit blast radius if the service is compromised.

Patch Information

Apply the fixed MedDream PACS Server release referenced in the Zero Day Initiative Advisory ZDI-25-244. At the time of publication no separate vendor advisory URL is listed in the NVD record, so administrators should contact MedDream directly to obtain the patched build and verify the fixed version against the ZDI write-up.

Workarounds

Block external DICOM submission paths at the network perimeter until the patch is applied.
Place a DICOM-aware proxy or validation gateway in front of the PACS server to drop malformed studies before they reach the parser.
Disable automated ingestion from untrusted sources and require manual review of inbound DICOM transfers.
Apply host-based exploit mitigations such as DEP and ASLR, and ensure stack protection compiler flags are active on the PACS host platform.

bash

# Example egress restriction for a PACS host on Linux (iptables)
iptables -A OUTPUT -o eth0 -d <MODALITY_SUBNET> -j ACCEPT
iptables -A OUTPUT -o eth0 -d <HIS_RIS_SUBNET> -j ACCEPT
iptables -A OUTPUT -o eth0 -j DROP