CVE-2025-5307: Santesoft Dicom Viewer Pro RCE Vulnerability

CVE-2025-5307 Overview

CVE-2025-5307 is a memory corruption vulnerability in Santesoft Sante DICOM Viewer Pro, a Digital Imaging and Communications in Medicine (DICOM) viewer used in clinical and medical imaging workflows. The flaw is classified as an out-of-bounds read [CWE-125]. A local attacker can exploit this issue to disclose memory contents and potentially execute arbitrary code on affected installations. Exploitation requires user interaction, typically by convincing a user to open a malicious DICOM file. The vulnerability was published to the National Vulnerability Database (NVD) on May 29, 2025, and is tracked by CISA Medical Advisory ICSMA-25-148-01.

Critical Impact
A local attacker who convinces a user to open a crafted DICOM file can read out-of-bounds memory and potentially execute arbitrary code in the context of the application.

Affected Products

Santesoft Sante DICOM Viewer Pro (versions prior to the vendor-supplied fix)
Windows installations of the Sante DICOM Viewer Pro product family
Clinical and medical imaging endpoints running vulnerable Sante DICOM software

Discovery Timeline

2025-05-29 - CVE-2025-5307 published to NVD and CISA Medical Advisory ICSMA-25-148-01 released
2025-10-15 - Last updated in NVD database

Technical Details for CVE-2025-5307

Vulnerability Analysis

The issue is a memory corruption defect categorized as an out-of-bounds read [CWE-125]. Sante DICOM Viewer Pro parses DICOM-formatted image files containing structured metadata, pixel data, and embedded tags. When the parser processes a malformed or maliciously crafted DICOM file, it reads memory outside of the intended buffer boundary. This out-of-bounds read can expose sensitive in-process memory to an attacker and, depending on the surrounding allocation state, can lead to arbitrary code execution within the user context.

Exploitation requires local access and user interaction. A user must open the crafted file in the viewer for the malicious payload to trigger. Successful exploitation impacts confidentiality, integrity, and availability of the affected installation.

Root Cause

The root cause is insufficient bounds checking during the parsing of attacker-controlled fields in a DICOM file. The application trusts length or offset values supplied in the file structure without validating them against the actual buffer size. When a crafted file specifies values outside the allocated region, the parser dereferences memory beyond the buffer, producing the out-of-bounds read condition.

Attack Vector

The attack vector is local and requires user interaction. A typical exploitation path involves an attacker delivering a malicious .dcm file to a clinician or medical imaging workstation through email, removable media, a shared network folder, or a Picture Archiving and Communication System (PACS) export. When the user opens the file in Sante DICOM Viewer Pro, the malformed structure triggers the out-of-bounds read during parsing. No network exposure of the application is required.

No public proof-of-concept exploit code is currently associated with this CVE. For technical specifics, refer to the CISA Medical Advisory ICSMA-25-148-01.

Detection Methods for CVE-2025-5307

Indicators of Compromise

Unexpected crashes, hangs, or abnormal termination of the Sante DICOM Viewer Pro process shortly after opening a DICOM file
DICOM files received from untrusted sources or arriving outside of normal PACS workflow channels
New or unexpected child processes spawned by the Sante DICOM Viewer Pro executable

Detection Strategies

Monitor endpoint process telemetry for Sante DICOM Viewer Pro launching unusual child processes, loading unsigned modules, or performing outbound network connections
Inspect Windows Error Reporting and application crash logs for faults originating in the Sante DICOM Viewer Pro process tied to DICOM file parsing
Apply file integrity and provenance checks on inbound .dcm files, flagging those that originate from email attachments or unmanaged removable media

Monitoring Recommendations

Track all file-open events for the viewer across clinical endpoints and correlate with the file source path
Alert on memory access violations and exception events generated by the viewer process
Centralize endpoint telemetry from imaging workstations into a security data lake for retrospective hunting after a vendor advisory update

How to Mitigate CVE-2025-5307

Immediate Actions Required

Upgrade Sante DICOM Viewer Pro to the latest version provided by the vendor as referenced in the SanteSoft download page
Restrict the opening of DICOM files to those received through trusted PACS workflows and verified clinical sources
Educate clinical staff to avoid opening DICOM files received from untrusted email or external media

Patch Information

Santesoft has published updated installers for Sante DICOM Viewer Pro on the official product download page. Administrators should download and deploy the latest vendor-supplied build to clinical workstations. Refer to the CISA Medical Advisory ICSMA-25-148-01 for vendor remediation guidance and to the SanteSoft DICOM Viewer download page to obtain the patched release.

Workarounds

Limit use of Sante DICOM Viewer Pro to dedicated, segmented clinical workstations until patched
Block inbound DICOM file delivery through email gateways and removable media policies on workstations running the viewer
Run the viewer under a standard user account with no administrative privileges to reduce the impact of successful exploitation

bash

# Configuration example: restrict .dcm file association handling via Windows AppLocker
# Block execution of Sante DICOM Viewer Pro outside of approved clinical workstations
New-AppLockerPolicy -RuleType Path -User Everyone `
  -PathCondition "C:\Program Files\Santesoft\Sante DICOM Viewer Pro\*" `
  -Action Deny | Set-AppLockerPolicy -Merge