CVE-2025-3484
Published: 22 May 2025
Summary
CVE-2025-3484 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Meddream Pacs Server. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 9.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-3484 is a stack-based buffer overflow in the DICOM file parsing logic of MedDream PACS Server. The flaw arises from missing validation on the length of attacker-supplied data before it is copied into a fixed-length stack buffer, and it carries a CVSS score of 9.8 with the CWE-121 classification.
Unauthenticated remote attackers can exploit the issue by supplying a malicious DICOM file, resulting in arbitrary code execution under the privileges of the service account. No user interaction or credentials are required for successful exploitation.
The vulnerability was originally reported as ZDI-CAN-25853 and is covered in the Zero Day Initiative advisory ZDI-25-242. The EPSS score remains flat at 0.0617 with no material increase observed after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-16098
Vulnerability details
MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MedDream PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw…
more
exists within the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25853.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.