Vulnerability

MicroDicom DICOM Viewer 2023.3 and prior overflows the heap on malicious DCM files

MedDevice Cyber Staff · Feb 29 · 2 min read · Via CISA ICSMA-24-060-01

CISA published advisory ICSMA-24-060-01 on February 29, 2024, covering two memory corruption flaws in MicroDicom DICOM Viewer, versions 2023.3 (Build 9342) and prior. Michael Heinzl reported them.

CVE-2024-22100 (CWE-122) is a heap-based buffer overflow that could let an attacker execute arbitrary code on the installation. CVE-2024-25578 (CWE-787) is an out-of-bounds write caused by missing validation of user-supplied data. Both score 7.8 under CVSS v3.1.

The trigger is a file. A user has to open a malicious DCM file, which is why the vector is local with user interaction and CISA says the flaws are not exploitable remotely. Imaging studies arrive from outside facilities as a matter of routine, so that bar is lower than it sounds.

MicroDicom fixed both issues in version 2024.1. CISA reported no known public exploitation at publication.

A DICOM parser is reading attacker-controlled input every time it opens a study from outside, and it should be fuzzed accordingly.

Are you a representative of MicroDicom? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade MicroDicom DICOM Viewer to version 2024.1, which fixes CVE-2024-22100 and CVE-2024-25578. Until every workstation is upgraded, treat DCM files from outside sources as untrusted and open them only on patched machines.

Upgrade to 2024.1. MicroDicom fixed both flaws in DICOM Viewer 2024.1.
Find every install. Viewers spread across many desktops, so inventory all copies at 2023.3 (Build 9342) and prior.
Handle outside studies carefully. Open DCM files from external sources only on patched workstations.
Fuzz the parser. Software makers should fuzz DICOM parsing in every release, since each opened file is untrusted input.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

DICOM or image parsing

Contributing

File import

DICOM Viewer

DICOM or image parsing File import

Fix the class in your product

A crafted file drives the parser out of bounds. As the maker, validate every length and offset against the real buffer before you copy, decode in a sandboxed least-privilege process, and fuzz the path continuously so the next bug is yours to find.

Bound every copy. Check declared sizes against allocated buffers before memcpy; prefer memory-safe parsers for new work.
Sandbox the decoder. Run it least-privilege and isolated so a crash or exploit is contained, not privileged.
Fuzz as a release gate. Run malformed-input fuzzing on every file-format parser before shipping.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
WatchMate Software	Anumana	Same signals	No feedback feed from manufacturer
Vitrea Software Package	Canon Medical	Same signals	No feedback feed from manufacturer
Image Suite	Carestream Health	Same signals	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same signals	No feedback feed from manufacturer
AutoSeg	Fujifilm Healthcare	Same signals	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same signals	No feedback feed from manufacturer
BreView	GE HealthCare	Same signals	No feedback feed from manufacturer
EchoPAC Software Only / EchoPAC Plug-in	GE HealthCare	Same signals	No feedback feed from manufacturer
MR Contour DL	GE HealthCare	Same signals	No feedback feed from manufacturer
Contour ProtégéAI+	MIM Software	Same signals	No feedback feed from manufacturer
Image Management V15	Philips	Same signals	No feedback feed from manufacturer
OptimMRI	Rebrain	Same signals	No feedback feed from manufacturer
syngo Application Software	Siemens Healthineers	Same signals	No feedback feed from manufacturer
ART-Plan+	TheraPanacea	Same signals	No feedback feed from manufacturer
Glaucoma Module	Topcon Healthcare	Same signals	No feedback feed from manufacturer

1 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What are CVE-2024-22100 and CVE-2024-25578 in MicroDicom DICOM Viewer?

CVE-2024-22100 is a heap-based buffer overflow and CVE-2024-25578 an out-of-bounds write in MicroDicom DICOM Viewer 2023.3 (Build 9342) and prior. Both score CVSS 7.8 and can lead to code execution when a user opens a malicious DCM file, per CISA advisory ICSMA-24-060-01 of February 29, 2024.

Which MicroDicom DICOM Viewer version fixes CVE-2024-22100?

MicroDicom DICOM Viewer version 2024.1 fixes CVE-2024-22100 and CVE-2024-25578, per CISA advisory ICSMA-24-060-01.

← Back to Vulnerabilities