CVE-2025-2480

High

Published: 20 March 2025

Published

20 March 2025

Modified

16 October 2025

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0018 39.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2480 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Santesoft Dicom Viewer Pro. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 39.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

SI-2 mandates timely identification, testing, and installation of patches for known vulnerabilities like CVE-2025-2480, directly eliminating the out-of-bounds write flaw.

SI-16 Memory Protection good match

prevent

SI-16 enforces memory protection mechanisms such as address space layout randomization and data execution prevention to mitigate exploitation of the out-of-bounds write leading to arbitrary code execution.

SI-10 Information Input Validation good match

prevent

SI-10 requires validation of external inputs like malicious DCM files to detect and reject malformed data that triggers the out-of-bounds write vulnerability.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

T1204.002 Malicious File Execution

An adversary may rely upon a user opening a malicious file in order to gain execution.

attack.mitre.org →

Why these techniques?

Out-of-bounds write in DICOM file parser enables arbitrary code execution upon opening a crafted file, directly mapping to client-side exploitation (T1203) triggered by user opening malicious file (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-bounds write, which requires a user to open a malicious DCM file, resulting in execution of arbitrary code by a local attacker.

Deeper analysisAI

Santesoft Sante DICOM Viewer Pro is affected by CVE-2025-2480, an out-of-bounds write vulnerability classified under CWE-787. Published on 2025-03-20, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw occurs when processing DICOM (DCM) files, allowing potential memory corruption upon opening a specially crafted file.

A local attacker can exploit this vulnerability by tricking a user into opening a malicious DCM file within the Sante DICOM Viewer Pro application. No special privileges are required (PR:N), though local access and user interaction are necessary. Successful exploitation leads to arbitrary code execution with the privileges of the user running the application, resulting in high impacts to confidentiality, integrity, and availability.

Mitigation details are outlined in CISA's ICS Medical Advisory ICSMA-25-079-01 and on the vendor's download page at https://santesoft.com/win/sante-dicom-viewer-pro/download.html, which likely provides access to patched versions.