CVE-2025-5481: Sante DICOM Viewer Pro RCE Vulnerability

CVE-2025-5481 Overview

CVE-2025-5481 is an out-of-bounds write vulnerability in Sante DICOM Viewer Pro that allows attackers to execute arbitrary code on affected installations. The flaw resides in the parsing logic for Digital Imaging and Communications in Medicine (DICOM) .dcm files. Exploitation requires user interaction: a victim must open a malicious DCM file or visit a page that delivers one.

The Zero Day Initiative (ZDI) tracked this issue as ZDI-CAN-26168 and published advisory ZDI-25-324. The vulnerability is classified under [CWE-787] (Out-of-bounds Write) and affects medical imaging workstations widely used in clinical environments.

Critical Impact
Attackers can execute arbitrary code in the context of the current user by tricking them into opening a crafted DCM file, compromising medical imaging workstations.

Affected Products

Santesoft Sante DICOM Viewer Pro (all versions prior to the vendor-released fix)
Windows workstations running Sante DICOM Viewer Pro
Clinical imaging environments processing untrusted DICOM files

Discovery Timeline

2025-06-06 - CVE-2025-5481 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5481

Vulnerability Analysis

The vulnerability exists in the routine that parses DICOM .dcm files within Sante DICOM Viewer Pro. DICOM files contain structured tags describing patient data, image metadata, and pixel arrays. The parser fails to properly validate user-supplied length or offset fields before writing parsed data into an allocated buffer. As a result, an attacker who crafts a malformed DCM file can write data past the end of the destination object.

An out-of-bounds write of this nature corrupts adjacent heap memory. Attackers can shape the heap to overwrite function pointers, virtual table entries, or other control data. Successful exploitation yields arbitrary code execution under the privileges of the user running the viewer. Because clinicians and technicians frequently run imaging software with elevated permissions, the impact extends to lateral movement within hospital networks.

Root Cause

The root cause is missing or insufficient bounds checking on attacker-controlled fields inside the DCM file format. The parser trusts length values embedded in DICOM tags and copies content into a fixed-size or undersized allocation without verifying the destination capacity. This is a classic [CWE-787] failure pattern affecting binary file parsers.

Attack Vector

The attack vector is local file processing with required user interaction. An attacker delivers a malicious DCM file through email attachments, removable media, shared imaging archives, or a web page that prompts a download. When a user opens the file in Sante DICOM Viewer Pro, the parser triggers the out-of-bounds write and the embedded shellcode executes. No authentication on the target system is required beyond opening the file.

The vulnerability is not known to be exploited in the wild and no public proof-of-concept exploit is available. See the Zero Day Initiative Advisory ZDI-25-324 for additional technical details.

Detection Methods for CVE-2025-5481

Indicators of Compromise

Unexpected child processes spawned by the Sante DICOM Viewer Pro executable, particularly cmd.exe, powershell.exe, or rundll32.exe
DCM files received from untrusted sources or located outside standard PACS (Picture Archiving and Communication System) directories
Crash events or Windows Error Reporting entries referencing the viewer process with access violation codes
Outbound network connections initiated by the viewer process to unfamiliar hosts

Detection Strategies

Monitor for process injection or memory anomalies originating from the DICOM viewer process
Apply behavioral identification rules that flag image-viewing applications spawning interactive shells or scripting engines
Inspect DCM files at the email and web gateway for malformed tag lengths or oversized embedded objects
Correlate user file-open events with subsequent suspicious process activity on the same host

Monitoring Recommendations

Enable detailed process creation logging (Windows Event ID 4688 with command-line auditing) on imaging workstations
Forward endpoint telemetry to a centralized data lake for cross-host correlation and retroactive hunting
Establish a baseline of normal DICOM viewer behavior and alert on deviations such as network egress or script execution
Track file hashes of DCM samples submitted to clinical workstations to identify repeated delivery of crafted payloads

How to Mitigate CVE-2025-5481

Immediate Actions Required

Update Sante DICOM Viewer Pro to the latest version released by Santesoft that addresses CVE-2025-5481
Restrict the ability to open DCM files from external or untrusted sources on clinical endpoints
Apply application allowlisting so that only signed, approved imaging tools can process DICOM data
Train clinical staff to validate the origin of DICOM files before opening them

Patch Information

Santesoft has addressed this issue in an updated release of Sante DICOM Viewer Pro. Administrators should consult the Zero Day Initiative Advisory ZDI-25-324 and the Santesoft vendor portal for the specific fixed version, then deploy the patched build across all workstations running the affected product. Verify version strings post-deployment to confirm coverage.

Workarounds

Disable file association for .dcm files until the patched version is installed
Run Sante DICOM Viewer Pro inside a restricted, sandboxed user context with no administrative rights
Block delivery of DCM attachments at email gateways for users who do not require external imaging exchange
Segment imaging workstations from general-purpose corporate networks to limit blast radius if exploitation succeeds

Behavioral identification engines such as those in Singularity Endpoint can flag anomalous child-process creation and memory corruption indicators emanating from imaging applications, providing a compensating control while patches are rolled out across clinical environments.