CVE-2025-2480
Published: 20 March 2025
Summary
CVE-2025-2480 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Santesoft Dicom Viewer Pro. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 40.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
Santesoft Sante DICOM Viewer Pro is affected by CVE-2025-2480, an out-of-bounds write vulnerability classified under CWE-787. Published on 2025-03-20, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The flaw occurs when processing DICOM (DCM) files, allowing potential memory corruption upon opening a specially crafted file.
A local attacker can exploit this vulnerability by tricking a user into opening a malicious DCM file within the Sante DICOM Viewer Pro application. No special privileges are required (PR:N), though local access and user interaction are necessary. Successful exploitation leads to arbitrary code execution with the privileges of the user running the application, resulting in high impacts to confidentiality, integrity, and availability.
Mitigation details are outlined in CISA's ICS Medical Advisory ICSMA-25-079-01 and on the vendor's download page at https://santesoft.com/win/sante-dicom-viewer-pro/download.html, which likely provides access to patched versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7169
Vulnerability details
Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-bounds write, which requires a user to open a malicious DCM file, resulting in execution of arbitrary code by a local attacker.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in DICOM file parser enables arbitrary code execution upon opening a crafted file, directly mapping to client-side exploitation (T1203) triggered by user opening malicious file (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely identification, testing, and installation of patches for known vulnerabilities like CVE-2025-2480, directly eliminating the out-of-bounds write flaw.
SI-16 enforces memory protection mechanisms such as address space layout randomization and data execution prevention to mitigate exploitation of the out-of-bounds write leading to arbitrary code execution.
SI-10 requires validation of external inputs like malicious DCM files to detect and reject malformed data that triggers the out-of-bounds write vulnerability.