MicroDicom patched, then patched again, for the same file-parser class

MicroDicom DICOM Viewer drew back-to-back advisories. ICSMA-25-121-01 in May, out-of-bounds write and read, both 8.8. Then ICSMA-25-160-01 in June, another out-of-bounds write, CVE-2025-5943 at 8.8. Michael Heinzl again.

An out-of-bounds write or read is a failure of a program to police the edges of its own memory. A parser walks a file expecting each field to describe a length and a type it can trust, and when a crafted field lies about its size, the code reads past the buffer it allocated or writes beyond it. Absent automatic bounds checking, that stray access is the seed of a crash or, in the write case, of attacker-controlled corruption.

Patch 2025.2, then patch 2025.3, for the same kind of bug in the same parser. That cadence says the fixes addressed instances, not the underlying pattern. Free and widely used DICOM viewers are quietly everywhere in clinical environments, so a crafted study or a malicious website reaches a lot of them.

The DICOM format is old, sprawling and permissive, with a long list of encodings and optional fields a viewer must accept from whatever source sends them. That breadth is what makes the parser a recurring soft spot, since every branch of the format is another path an adversary can probe. Because a viewer opens files arriving from imaging systems, mail and the web, hostile input does not need an insider to deliver it.

Repeated memory-corruption findings in one product do not call for another point fix. They call for hardening the parser: memory-safe handling, fuzzing in CI, and treating every field of the format as hostile.

The workstation that renders a study is often the same machine a radiologist uses to read, dictate and sign off, so code execution there reaches into the reading workflow and the credentials sitting on the desk. A viewer subverted by the very files it exists to display inverts the trust a clinician places in the tool. The disruption need not be dramatic to matter, since a reader who cannot open a study cannot report on it.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

MicroDicom DICOM Viewer took out-of-bounds write and read findings a month apart (ICSMA-25-121-01 and ICSMA-25-160-01), both reachable by opening a crafted DICOM file, both near CVSS 8.8. Update to the latest version and treat outside DICOM files as untrusted input to a fragile parser.

Update to the current version. Apply the latest MicroDicom release that closes both out-of-bounds findings.
Quarantine outside studies. Open files from outside your own modalities in a constrained account until the viewer is current.
Expect more parser bugs. Two findings in one class a month apart signals the parser needs fuzzing, not just point patches.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

parse_image

Contributing

app_file_upload net_cloud sys_ots_software data_phi use_hospital_net

EMB3D

PID-3122

Fix the class in your product

A crafted file drives the parser out of bounds. As the maker, validate every length and offset against the real buffer before you copy, decode in a sandboxed least-privilege process, and fuzz the path continuously so the next bug is yours to find.

Bound every copy. Check declared sizes against allocated buffers before memcpy; prefer memory-safe parsers for new work.
Sandbox the decoder. Run it least-privilege and isolated so a crash or exploit is contained, not privileged.
Fuzz as a release gate. Run malformed-input fuzzing on every file-format parser before shipping.

Mapped EMB3D mitigations

Questions & Answers

What are the MicroDicom DICOM Viewer advisories?

ICSMA-25-121-01 in May 2025 covered an out-of-bounds write and read, both 8.8, and ICSMA-25-160-01 in June added another out-of-bounds write, CVE-2025-5943 at 8.8. Opening a crafted DICOM file triggers them. Michael Heinzl reported the findings.

Which versions fix the MicroDicom flaws?

Patch releases 2025.2 and then 2025.3. Back-to-back findings in the same parser argue for fuzzing in CI and memory-safe handling rather than another point fix.

← Back to Vulnerabilities