CVE-2025-2581
Published: 21 March 2025
Summary
CVE-2025-2581 is a medium-severity Wrap or Wraparound (CWE-191) vulnerability in Xmedcon Project Xmedcon. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Deeper analysis
CVE-2025-2581 is an integer underflow vulnerability (CWE-189, CWE-191) affecting the malloc function in the DICOM File Handler component of xmedcon version 0.25.0. Published on 2025-03-21, it carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), indicating medium severity with potential for limited disruption.
An unauthenticated attacker can exploit this remotely by supplying a malicious DICOM file that triggers the underflow during processing. Exploitation requires user interaction, such as opening the file in xmedcon, and results in a denial-of-service condition through application crash, with no impact on confidentiality or integrity.
Advisories recommend upgrading to xmedcon version 0.25.1 to remediate the issue. Details are documented in VulDB entries (ctiid.300541, id.300541, submit.522216), the xmedcon project release notes, and a Debian LTS announcement.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7270
Vulnerability details
A vulnerability has been found in xmedcon 0.25.0 and classified as problematic. Affected by this vulnerability is the function malloc of the component DICOM File Handler. The manipulation leads to integer underflow. The attack can be launched remotely. Upgrading to…
more
version 0.25.1 is able to address this issue. It is recommended to upgrade the affected component.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The integer underflow vulnerability (CWE-191) in xmedcon's DICOM file handler causes memory corruption (SIGBUS), enabling remote exploitation of client-side software for code execution (T1203) or denial-of-service via crash (T1499.004) when a user processes a malformed DICOM file.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires timely patching of the integer underflow vulnerability by upgrading xmedcon to version 0.25.1, directly eliminating the exploitable condition.
Information input validation scrutinizes DICOM files for malformed data that triggers the integer underflow in the malloc function during remote file processing.
Error handling ensures graceful management of integer underflow errors in the DICOM file handler to prevent application crashes and denial-of-service.