LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

MicroDicom patched, then patched again, for the same file-parser class

MedDevice Cyber Staff · Jun 10 · 2 min read · Via CISA ICSMA-25-160-01 (June out-of-bounds write)

MicroDicom DICOM Viewer drew back-to-back advisories. ICSMA-25-121-01 in May, out-of-bounds write and read, both 8.8. Then ICSMA-25-160-01 in June, another out-of-bounds write, CVE-2025-5943 at 8.8. Michael Heinzl again.

Patch 2025.2, then patch 2025.3, for the same kind of bug in the same parser. That cadence says the fixes addressed instances, not the underlying pattern. Free and widely used DICOM viewers are quietly everywhere in clinical environments, so a crafted study or a malicious website reaches a lot of them.

Repeated memory-corruption findings in one product do not call for another point fix. They call for hardening the parser: memory-safe handling, fuzzing in CI, and treating every field of the format as hostile.

Remediation Desk

MicroDicom DICOM Viewer took out-of-bounds write and read findings a month apart (ICSMA-25-121-01 and ICSMA-25-160-01), both reachable by opening a crafted DICOM file, both near CVSS 8.8. Update to the latest version and treat outside DICOM files as untrusted input to a fragile parser.

Update to the current version. Apply the latest MicroDicom release that closes both out-of-bounds findings.
Quarantine outside studies. Open files from outside your own modalities in a constrained account until the viewer is current.
Expect more parser bugs. Two findings in one class a month apart signals the parser needs fuzzing, not just point patches.

Sources

Questions & Answers

What are the MicroDicom DICOM Viewer advisories?

ICSMA-25-121-01 in May 2025 covered an out-of-bounds write and read, both 8.8, and ICSMA-25-160-01 in June added another out-of-bounds write, CVE-2025-5943 at 8.8. Opening a crafted DICOM file triggers them. Michael Heinzl reported the findings.

Which versions fix the MicroDicom flaws?

Patch releases 2025.2 and then 2025.3. Back-to-back findings in the same parser argue for fuzzing in CI and memory-safe handling rather than another point fix.

← Back to Vulnerabilities