CVE-2025-2263
Published: 13 March 2025
Summary
CVE-2025-2263 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Santesoft Sante Pacs Server. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 12.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates this CVE by applying patches or updates to fix the stack buffer overflow in the decryption function.
Memory protection mechanisms like stack canaries, ASLR, and DEP prevent exploitation of the stack-based buffer overflow for arbitrary code execution.
Input validation on the length of encrypted username and password fields prevents supplying excessively long data that overflows the fixed decryption buffer.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote stack-based buffer overflow in web server login via crafted encrypted credentials enables exploitation of a public-facing application for potential RCE.
NVD Description
During login to the web server in "Sante PACS Server.exe", OpenSSL function EVP_DecryptUpdate is called to decrypt the username and password. A fixed 0x80-byte stack-based buffer is passed to the function as the output buffer. A stack-based buffer overflow exists…
more
if a long encrypted username or password is supplied by an unauthenticated remote attacker.
Deeper analysisAI
CVE-2025-2263 is a stack-based buffer overflow vulnerability affecting the web server login functionality in Sante PACS Server.exe. The issue occurs when the OpenSSL function EVP_DecryptUpdate is invoked to decrypt the supplied username and password, passing a fixed 0x80-byte stack-based buffer as the output parameter. Supplying a long encrypted username or password exceeds this buffer size, triggering the overflow.
An unauthenticated remote attacker can exploit this vulnerability over the network by submitting a login request with an excessively long encrypted credential. The CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects its critical severity, enabling potential arbitrary code execution with high impacts on confidentiality, integrity, and availability. It maps to CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write).
Mitigation details are available in the Tenable research advisory at https://www.tenable.com/security/research/tra-2025-08, published on 2025-03-13.
Details
- CWE(s)