CVE-2025-14501
Published: 23 December 2025
Summary
CVE-2025-14501 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Zerodayinitiative (inferred from references). Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 24.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-14501 is a NULL pointer dereference vulnerability in Sante PACS Server that occurs during handling of the HTTP Content-Length header. The flaw stems from insufficient validation of a pointer before it is accessed, allowing an unauthenticated remote attacker to trigger a denial-of-service condition on affected installations. It carries a CVSS 3.0 base score of 7.5 and is tracked under CWE-476; the issue was originally reported as ZDI-CAN-26770.
An attacker can exploit the vulnerability by sending a specially crafted HTTP request containing a malicious Content-Length header value. No authentication or user interaction is required, and successful exploitation results only in a denial-of-service state with no impact on confidentiality or integrity.
The reference advisory from Zero Day Initiative (ZDI-25-1104) provides technical details of the flaw and is the primary source for coordinated disclosure information; organizations should consult vendor or ZDI guidance for available patches or workarounds.
EPSS for this CVE rose from a low baseline to a peak of 0.0162, indicating increased exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-205008
Vulnerability details
Sante PACS Server HTTP Content-Length Header Handling NULL Pointer Dereference Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Sante PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw…
more
exists within the handling of HTTP Content-Length header. The issue results from the lack of proper validation of a pointer prior to accessing it. An attacker can leverage this vulnerability to create a denial-of-service condition on the system. Was ZDI-CAN-26770.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.