CVE-2025-3482: Meddream PACS Server RCE Vulnerability

CVE-2025-3482 Overview

CVE-2025-3482 is a stack-based buffer overflow vulnerability in MedDream PACS Server that allows attackers to execute arbitrary code through malicious DICOM file parsing. The flaw exists in the DICOM file parsing routine, where user-supplied data is copied to a fixed-length stack buffer without proper length validation. Successful exploitation grants code execution in the context of the service account. The vulnerability is tracked as ZDI-CAN-25826 and was disclosed by the Zero Day Initiative as ZDI-25-244. Although authentication is not required, the attack vector is local and requires user interaction to trigger parsing of a crafted DICOM file.

Critical Impact

Attackers who deliver a malicious DICOM file to a vulnerable MedDream PACS Server can execute arbitrary code under the service account, compromising medical imaging infrastructure and patient data.

Affected Products

• MedDream PACS Server (Premium edition)
• Component: meddream:pacs_server
• All versions prior to the vendor-issued fix referenced in ZDI-25-244

Discovery Timeline

• 2025-05-22 - CVE-2025-3482 published to NVD
• 2025-07-11 - Last updated in NVD database
• Reference advisory - Zero Day Initiative published ZDI-25-244

Technical Details for CVE-2025-3482

Vulnerability Analysis

The vulnerability resides in the DICOM (Digital Imaging and Communications in Medicine) file parser within MedDream PACS Server. The parser copies attacker-controlled data from a DICOM file into a fixed-length stack buffer without validating the source length. This classic stack-based buffer overflow [CWE-121] overwrites adjacent stack memory, including saved return addresses and structured exception handler pointers on Windows builds.

The Common Weakness Enumeration classifies this as CWE-121 (Stack-based Buffer Overflow). An attacker who controls the DICOM input can corrupt control flow data and redirect execution to arbitrary code. Because PACS servers typically run with elevated service privileges in clinical environments, successful exploitation yields high-impact code execution against medical imaging infrastructure.

Root Cause

The root cause is the absence of bounds checking when the DICOM parser copies a length-prefixed or tag-delimited field from the input file into a fixed-size stack buffer. The parser trusts attacker-supplied size or terminator values, allowing the copy operation to extend beyond the buffer boundary.

Attack Vector

An attacker crafts a malicious DICOM file containing an oversized field designed to overflow the target buffer. The file must be processed by the MedDream PACS Server, which typically occurs when the file is uploaded, imported, or queued for parsing. Although the CVSS vector indicates a local attack vector with user interaction required, PACS workflows commonly ingest DICOM files from networked modalities, workstations, and remote sources, expanding the practical exposure.

The vulnerability does not require authentication. Once the malicious file is parsed, the attacker gains code execution in the context of the PACS service account.

No public proof-of-concept code has been released. Technical details are available in the Zero Day Initiative Advisory ZDI-25-244.

Detection Methods for CVE-2025-3482

Indicators of Compromise

• Unexpected crashes, restarts, or access violations in the MedDream PACS Server service process
• DICOM files with anomalously large tag values, malformed length fields, or non-standard structure submitted to ingestion endpoints
• Child processes spawned by the PACS service account that do not match normal operational baselines
• Outbound network connections originating from the PACS server to unrecognized hosts following DICOM file processing

Detection Strategies

• Monitor the PACS server process for abnormal termination, exception events, and Windows Error Reporting (WER) entries tied to the DICOM parser binary
• Deploy endpoint behavioral identification to flag post-exploitation activity such as shell spawning, credential access, or lateral movement from the PACS service account
• Inspect DICOM ingestion logs for files exceeding expected size thresholds or with malformed metadata
• Hunt for anomalous parent-child process relationships where the MedDream service launches cmd.exe, powershell.exe, or other interpreters

Monitoring Recommendations

• Enable detailed process creation and command-line auditing on hosts running MedDream PACS Server
• Forward PACS application logs, Windows Security logs, and Sysmon telemetry to a centralized SIEM for correlation
• Establish a baseline of legitimate DICOM sources and alert on files arriving from unexpected origins
• Track file integrity of MedDream installation directories to detect tampering after potential exploitation

How to Mitigate CVE-2025-3482

Immediate Actions Required

• Apply the vendor patch referenced in ZDI-25-244 as soon as it is available from MedDream
• Restrict DICOM ingestion to authenticated, trusted modalities and workstations on segmented clinical networks
• Run the PACS service under the least-privileged account required for operation, avoiding LocalSystem or domain administrator contexts
• Validate DICOM files at a network boundary or proxy before delivery to the PACS server

Patch Information

MedDream has been notified through the Zero Day Initiative disclosure process. Administrators should consult the Zero Day Initiative Advisory ZDI-25-244 and the MedDream vendor portal for fixed version information and upgrade guidance. No vendor advisory URL was published in the NVD record at the time of writing.

Workarounds

• Isolate the PACS server on a dedicated VLAN with strict ingress controls limiting DICOM traffic to known modality IP addresses
• Disable or restrict any web-facing DICOM upload interfaces until the patch is applied
• Enforce file size and structural validation on DICOM submissions at an upstream gateway
• Enable Windows exploit mitigations such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG) on the host where supported

# Example: restrict inbound DICOM (TCP/104, 11112) to known modality subnet
netsh advfirewall firewall add rule name="PACS-DICOM-Allow" ^
  dir=in action=allow protocol=TCP localport=104,11112 ^
  remoteip=10.20.30.0/24

netsh advfirewall firewall add rule name="PACS-DICOM-Block" ^
  dir=in action=block protocol=TCP localport=104,11112