CVE-2025-3483: MedDream PACS Server RCE Vulnerability

CVE-2025-3483 Overview

CVE-2025-3483 is a stack-based buffer overflow vulnerability [CWE-121] in MedDream PACS Server affecting the parsing of Digital Imaging and Communications in Medicine (DICOM) files. The flaw stems from missing length validation of user-supplied data before it is copied into a fixed-length stack buffer. An attacker who convinces a user to process a malicious DICOM file can execute arbitrary code in the context of the service account. The issue was reported through the Trend Micro Zero Day Initiative as ZDI-CAN-25825 and disclosed publicly as ZDI-25-243.

Critical Impact
Successful exploitation results in arbitrary code execution under the PACS service account, providing access to medical imaging data and a foothold into clinical infrastructure.

Affected Products

MedDream PACS Server (Premium edition)
Deployments processing untrusted DICOM input
Installations prior to the vendor-issued fix referenced in ZDI-25-243

Discovery Timeline

2025-05-22 - CVE-2025-3483 published to the National Vulnerability Database
2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-3483

Vulnerability Analysis

MedDream PACS Server processes DICOM files as part of its Picture Archiving and Communication System (PACS) workflow. The vulnerable code path reads attacker-controlled length fields from the DICOM container and copies the associated payload into a fixed-size buffer on the stack. Because the implementation does not verify that the supplied length fits the destination buffer, an oversized field overruns adjacent stack memory, including saved return addresses and structured exception handlers.

An attacker can shape the overflow to redirect control flow and execute arbitrary code with the privileges of the PACS service process. The Zero Day Initiative advisory ZDI-25-243 categorizes this as a local attack vector requiring user interaction, consistent with workflows where a clinician or automated importer opens a crafted DICOM study. Exploitation does not require authentication to the PACS application itself.

Root Cause

The root cause is improper input validation [CWE-121] during DICOM tag parsing. The parser trusts size fields embedded in the file and uses them as the copy length, rather than enforcing the bounds of the destination buffer. This pattern is a classic stack-based buffer overflow.

Attack Vector

Delivery occurs through any channel that feeds DICOM data into the server: study imports, modality worklist submissions, or files placed in monitored ingest folders. When the vulnerable parser processes the crafted file, the overflow triggers and the attacker gains code execution in the service context. Refer to the Zero Day Initiative Advisory ZDI-25-243 for the technical writeup.

// No verified public proof-of-concept code is available.
// See ZDI-25-243 for vendor-coordinated technical details.

Detection Methods for CVE-2025-3483

Indicators of Compromise

Unexpected crashes, restarts, or Windows Error Reporting events for the MedDream PACS Server process
DICOM files with abnormally large tag length fields or malformed Value Representation (VR) elements in ingest directories
Child processes spawned by the PACS service that are not part of normal operation, such as command shells or scripting hosts
Outbound network connections from the PACS service host to unrecognized destinations following DICOM import

Detection Strategies

Monitor process lineage on the PACS host and alert on any non-standard child process of the MedDream service binary
Inspect ingested DICOM files at the gateway for malformed headers and oversized element lengths prior to delivery to the parser
Correlate service crashes with subsequent process creation or persistence events to identify post-exploitation activity

Monitoring Recommendations

Enable verbose application and Windows event logging on PACS servers and forward logs to a centralized SIEM
Baseline normal DICOM import sources and alert on imports from unexpected modalities or external senders
Track file write activity in DICOM ingest paths and flag files received outside scheduled clinical workflows

How to Mitigate CVE-2025-3483

Immediate Actions Required

Identify all MedDream PACS Server instances, including test and disaster-recovery deployments, and inventory their versions
Restrict DICOM ingest to authenticated, network-segmented sources and block direct exposure to untrusted networks
Apply the vendor-supplied update referenced in ZDI-25-243 as soon as it is validated in a staging environment
Limit the PACS service account to the minimum privileges required to reduce the blast radius of successful exploitation

Patch Information

MedDream has been notified through the Zero Day Initiative coordinated disclosure process. Administrators should consult the Zero Day Initiative Advisory ZDI-25-243 and the MedDream vendor portal for the fixed build and upgrade guidance.

Workarounds

Place the PACS server behind a DICOM-aware gateway that validates tag lengths and rejects malformed studies before they reach the parser
Disable or firewall-off DICOM listener ports that are not required for clinical operations
Enforce allowlists of trusted Application Entity Titles (AETs) and source IP addresses for inbound DICOM associations
Run the PACS service under a dedicated low-privilege account and apply application-level exploit mitigations such as Data Execution Prevention (DEP) and Control Flow Guard (CFG)

bash

# Example: restrict inbound DICOM port 104 to known modality subnets (Windows firewall)
netsh advfirewall firewall add rule name="DICOM-Allowlist" dir=in action=allow \
  protocol=TCP localport=104 remoteip=10.10.20.0/24,10.10.21.0/24
netsh advfirewall firewall add rule name="DICOM-Deny-Other" dir=in action=block \
  protocol=TCP localport=104