CVE-2025-35975 Overview
CVE-2025-35975 is an out-of-bounds write vulnerability (CWE-787) affecting MicroDicom DICOM Viewer, a medical imaging application used for viewing DICOM (Digital Imaging and Communications in Medicine) files. The vulnerability allows an attacker to execute arbitrary code on a victim's system when a maliciously crafted DCM file is opened by the user.
This vulnerability is particularly concerning in healthcare environments where DICOM viewers are essential tools for medical professionals reviewing diagnostic imaging data such as X-rays, CT scans, and MRIs. The attack requires user interaction—specifically, opening a malicious DCM file—making it a client-side attack vector that could be delivered through phishing campaigns or compromised medical image sharing systems.
Critical Impact
Successful exploitation of this out-of-bounds write vulnerability allows attackers to execute arbitrary code with the privileges of the user running MicroDicom DICOM Viewer, potentially leading to full system compromise in healthcare environments.
Affected Products
- MicroDicom DICOM Viewer (specific versions detailed in CISA Medical Advisory ICSMA-25-121-01)
Discovery Timeline
- May 1, 2025 - CVE-2025-35975 published to NVD
- April 15, 2026 - Last updated in NVD database
Technical Details for CVE-2025-35975
Vulnerability Analysis
This out-of-bounds write vulnerability occurs when MicroDicom DICOM Viewer processes specially crafted DCM files. During parsing of the DICOM file structure, the application fails to properly validate the boundaries of memory write operations, allowing data to be written beyond the allocated buffer space.
The vulnerability requires user interaction for exploitation—the victim must open a malicious DCM file. This attack pattern is consistent with targeted attacks against healthcare organizations where medical imaging files are routinely shared between facilities, departments, and practitioners. An attacker could embed malicious payloads within DCM files that appear legitimate, potentially bypassing security controls that don't inspect DICOM file contents.
The network-based attack vector indicates that malicious files could be delivered through various means including email attachments, compromised PACS (Picture Archiving and Communication System) servers, or malicious downloads from file-sharing platforms commonly used in healthcare environments.
Root Cause
The root cause of CVE-2025-35975 is improper validation of data lengths and buffer boundaries when processing DICOM file structures. When parsing certain elements within a DCM file, the application allocates a buffer of a predetermined size but fails to verify that subsequent write operations remain within the allocated memory region. This allows an attacker to craft a DCM file with malformed data structures that trigger writes beyond the buffer boundary.
Attack Vector
The attack requires an attacker to craft a malicious DCM file containing specially constructed DICOM elements designed to trigger the out-of-bounds write condition. The attack scenario typically involves:
- Attacker creates a malicious DCM file with crafted data structures
- The file is delivered to the victim through email, file sharing, or a compromised medical imaging system
- Victim opens the malicious DCM file using MicroDicom DICOM Viewer
- The parser encounters the malformed data and performs an out-of-bounds write
- Attacker-controlled code is executed with the privileges of the current user
The vulnerability mechanism involves improper memory handling during DICOM file parsing. When processing certain DICOM elements, the application fails to validate that data lengths specified in the file match the actual buffer capacity. For detailed technical information, refer to the CISA Medical Advisory ICSMA-25-121-01.
Detection Methods for CVE-2025-35975
Indicators of Compromise
- Unexpected crashes or abnormal behavior of MicroDicom DICOM Viewer application
- Presence of DCM files with unusual or malformed internal structures
- Suspicious child processes spawned by the DICOM Viewer application
- Unexpected network connections initiated by the DICOM Viewer process
Detection Strategies
- Monitor for MicroDicom DICOM Viewer process behavior anomalies including unexpected memory access patterns or crashes
- Implement file integrity monitoring for DCM files received from external sources
- Deploy endpoint detection and response (EDR) solutions capable of detecting memory corruption exploitation attempts
- Configure application allowlisting to detect unauthorized code execution from medical imaging applications
Monitoring Recommendations
- Enable detailed logging for DICOM Viewer application activity
- Monitor for unusual file access patterns in medical imaging directories
- Track process lineage to identify suspicious child processes spawned by microdicom.exe or similar executables
- Implement network monitoring for unexpected outbound connections from medical imaging workstations
How to Mitigate CVE-2025-35975
Immediate Actions Required
- Review and apply patches or updates from MicroDicom as referenced in the CISA advisory
- Restrict DCM file sources to trusted and verified medical imaging systems only
- Implement network segmentation to isolate medical imaging workstations
- Educate healthcare staff about the risks of opening DCM files from untrusted sources
- Deploy endpoint protection with memory exploit mitigation capabilities
Patch Information
Refer to the CISA Medical Advisory ICSMA-25-121-01 for the latest patch information and recommended versions. Organizations should contact MicroDicom directly for specific patch availability and update instructions for their installed versions.
Workarounds
- Implement strict file source validation and only accept DCM files from trusted PACS systems and verified healthcare partners
- Run MicroDicom DICOM Viewer with minimal user privileges to limit the impact of successful exploitation
- Use application sandboxing or virtualization when reviewing DCM files from unknown or untrusted sources
- Deploy Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) on systems running the DICOM Viewer
# Configuration example - Windows Defender Exploit Protection settings
# Enable DEP and ASLR for MicroDicom applications
Set-ProcessMitigation -Name microdicom.exe -Enable DEP,ForceRelocateImages,BottomUp,HighEntropy
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
