Vulnerability

Pixmeo OsiriX MD crashes on crafted DICOM files and sends web portal credentials in cleartext

MedDevice Cyber Staff · May 8 · 3 min read · Via CISA ICSMA-25-128-01

CISA published advisory ICSMA-25-128-01 on May 8, 2025, covering three vulnerabilities in Pixmeo OsiriX MD, versions 14.0.1 (Build 2024-02-28) and prior. Chizuru Toyama and Canaan Kao of TXOne Networks reported them.

CVE-2025-27578 (CWE-416, CVSS v3 7.5) is a use-after-free that an attacker can trigger by uploading a crafted DICOM file, causing memory corruption and a denial of service. CVE-2025-31946 (CWE-416, CVSS 6.2) is the local twin: importing a crafted DICOM file corrupts memory or crashes the system.

CVE-2025-27720 (CWE-319, CVSS 7.4) is in the OsiriX MD Web Portal, which sends credential information without encryption. Anyone positioned on the network path could capture logins.

Pixmeo recommends downloading the latest version of OsiriX MD and directs support questions to Pixmeo. The advisory does not name a specific fixed build.

A viewer that also runs a web portal and a DICOM listener is a server, and it needs TLS and the patch cadence of one.

Are you a representative of Pixmeo? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Update OsiriX MD to the latest version from Pixmeo. Until then, keep the Web Portal off untrusted networks or disable it, change any credentials used through it, and accept DICOM uploads only from known sources.

Install the latest OsiriX MD. Download the current release from Pixmeo and retire 14.0.1 and earlier.
Protect the Web Portal. Disable it or restrict it to trusted networks, and rotate credentials that crossed it.
Limit DICOM senders. Allow uploads only from known modalities and PACS nodes.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

DICOM or image parsing

Contributing

File import Web interface User accounts

OsiriX MD

PID-311 PID-4112 DICOM or image parsing File import Web interface

Fix the class in your product

A crafted file drives the parser out of bounds. As the maker, validate every length and offset against the real buffer before you copy, decode in a sandboxed least-privilege process, and fuzz the path continuously so the next bug is yours to find.

Bound every copy. Check declared sizes against allocated buffers before memcpy; prefer memory-safe parsers for new work.
Sandbox the decoder. Run it least-privilege and isolated so a crash or exploit is contained, not privileged.
Fuzz as a release gate. Run malformed-input fuzzing on every file-format parser before shipping.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aPROMISE	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Heartvue.Proton	HeartVue	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Aperio GT 450 DX	Leica Biosystems	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novo	PathAI	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
aetherSlide	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Management V15	Philips	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
qER	Qure.ai	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
OptimMRI	Rebrain	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Syngo Carbon Space VA30A	Siemens Healthineers	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Harmony Referral System	Topcon Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
AI Segmentation	Varian	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer

1 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2025-27578 in Pixmeo OsiriX MD?

CVE-2025-27578 (CWE-416, CVSS v3 7.5) is a use-after-free in Pixmeo OsiriX MD 14.0.1 and prior that an attacker can trigger by uploading a crafted DICOM file, causing memory corruption and a denial of service. CISA published it in ICSMA-25-128-01 on May 8, 2025.

Does the OsiriX MD Web Portal encrypt credentials?

No, in affected versions. CVE-2025-27720 (CWE-319, CVSS 7.4) means the Pixmeo OsiriX MD Web Portal in 14.0.1 and prior sends credential information without encryption, per CISA advisory ICSMA-25-128-01 from May 8, 2025. Pixmeo recommends the latest version.

← Back to Vulnerabilities