CVE-2025-36521: MicroDicom DICOM Viewer Buffer Overflow

CVE-2025-36521 Overview

CVE-2025-36521 is an out-of-bounds read vulnerability affecting MicroDicom DICOM Viewer, a medical imaging application used to view DICOM (Digital Imaging and Communications in Medicine) files. The vulnerability allows an attacker to cause memory corruption within the application when a user opens a specially crafted malicious DCM file.

This vulnerability is particularly concerning in healthcare environments where DICOM viewers are commonly used to process medical imaging data from various sources. Exploitation requires user interaction, specifically opening a malicious DCM file, making social engineering attacks a viable delivery mechanism.

Critical Impact

Successful exploitation of this out-of-bounds read vulnerability could allow attackers to cause memory corruption in MicroDicom DICOM Viewer, potentially leading to application crashes, information disclosure, or further exploitation in healthcare imaging workflows.

Affected Products

• MicroDicom DICOM Viewer (versions prior to patched release)
• Healthcare systems utilizing MicroDicom for medical image viewing
• Windows-based workstations with MicroDicom installed

Discovery Timeline

• 2025-05-01 - CVE-2025-36521 published to NVD
• 2025-05-02 - Last updated in NVD database

Technical Details for CVE-2025-36521

Vulnerability Analysis

This vulnerability is classified under CWE-125 (Out-of-Bounds Read), a memory safety issue that occurs when software reads data past the end, or before the beginning, of the intended buffer. In the context of MicroDicom DICOM Viewer, the out-of-bounds read occurs during the parsing of DCM file formats.

When processing a maliciously crafted DICOM file, the application fails to properly validate buffer boundaries before reading data, allowing the read operation to access memory locations outside the allocated buffer space. This type of vulnerability can expose sensitive information stored in adjacent memory regions and may cause application instability or crashes.

The attack requires network-based delivery of the malicious file and user interaction to open it, but once triggered, the impact affects the confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability lies in insufficient bounds checking during DICOM file parsing operations. When MicroDicom DICOM Viewer processes DCM files, it reads structured data from the file into memory buffers. The application fails to properly validate that read operations remain within the boundaries of allocated memory regions, allowing crafted input to trigger reads beyond buffer limits.

DICOM files contain complex hierarchical data structures with variable-length fields, making proper bounds validation critical. The vulnerability likely exists in the parsing logic that handles these variable-length elements without adequate size verification.

Attack Vector

The attack vector for CVE-2025-36521 requires an attacker to craft a malicious DCM file containing data designed to trigger the out-of-bounds read condition. The attack proceeds as follows:

1. File Crafting: The attacker creates a specially crafted DICOM file with malformed data structures or length fields designed to cause buffer overruns during parsing
2. Delivery: The malicious file is delivered to the victim via email attachment, file share, PACS system, or other means common in healthcare environments
3. Execution: The victim opens the malicious DCM file using MicroDicom DICOM Viewer
4. Exploitation: The parsing routines read past allocated buffer boundaries, causing memory corruption

The vulnerability manifests during the DICOM file parsing process when the application processes malformed data structures. When encountering specially crafted length fields or nested elements, the parser attempts to read data beyond the bounds of the allocated buffer, resulting in memory corruption. For detailed technical information, refer to the CISA Medical Advisory ICSMA-25-121-01.

Detection Methods for CVE-2025-36521

Indicators of Compromise

• Unexpected crashes or instability in MicroDicom DICOM Viewer application
• Memory access violation errors logged by the operating system
• Unusual DCM files with abnormal file sizes or structures in imaging directories
• Application crash dumps indicating memory corruption in MicroDicom processes

Detection Strategies

• Monitor for MicroDicom application crashes and memory access violations
• Implement file integrity monitoring for incoming DICOM files
• Deploy endpoint detection solutions to identify exploitation attempts targeting medical imaging applications
• Review Windows Event logs for application error events related to MicroDicom processes

Monitoring Recommendations

• Enable application crash reporting and centralize crash dump collection for analysis
• Implement network traffic analysis for unusual file transfers to imaging workstations
• Monitor user activity logs for DICOM file access patterns
• Configure SIEM alerts for repeated MicroDicom crashes or error events

How to Mitigate CVE-2025-36521

Immediate Actions Required

• Update MicroDicom DICOM Viewer to the latest available version from the MicroDicom Download Page
• Restrict the opening of DICOM files from untrusted or unknown sources
• Implement network segmentation to isolate medical imaging workstations
• Train healthcare staff to recognize and avoid suspicious file attachments

Patch Information

MicroDicom has released an updated version addressing this vulnerability. Organizations should download and install the latest version from the official MicroDicom Download Page. CISA has published a medical advisory with additional guidance available at ICSMA-25-121-01.

Healthcare organizations should coordinate updates with their IT security teams to ensure minimal disruption to clinical workflows while promptly addressing this security issue.

Workarounds

• Implement application whitelisting to control which applications can open DCM files
• Configure email filtering to block or quarantine incoming DICOM file attachments from external sources
• Use a dedicated, isolated workstation for viewing DICOM files from untrusted sources
• Enable Windows Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR) for additional exploit mitigation

# Windows command to verify DEP status
wmic OS Get DataExecutionPrevention_SupportPolicy

# Enable DEP for all programs (run as Administrator)
bcdedit /set nx AlwaysOn