LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Two rounds of memory-corruption bugs in one DICOM viewer

MedDevice Cyber Staff · Mar 20 · 2 min read · Via CISA ICSMA-25-079-01 (out-of-bounds write)

Santesoft Sante DICOM Viewer Pro drew two advisories in three months. ICSMA-25-079-01 in March, an out-of-bounds write, CVE-2025-2480 at 7.8. Then ICSMA-25-148-01 in May, an out-of-bounds read, CVE-2025-5307. Michael Heinzl reported both.

Open a crafted DCM file, corrupt memory, and in the write case that is a path to code execution on the workstation. When one memory-corruption bug turns up in a file parser, more are usually nearby, because the code was written without a hostile-input mindset throughout. A single fuzzing campaign against the DICOM parser would likely have surfaced both, and that campaign is cheaper than two advisories.

Remediation Desk

CISA hit Sante DICOM Viewer Pro twice in 2025, an out-of-bounds write (ICSMA-25-079-01) and later an out-of-bounds read (ICSMA-25-148-01), both triggered by opening a crafted file. Update to the current version and handle outside DICOM files as untrusted input.

Update to the current release. Apply the latest Sante DICOM Viewer Pro version that closes both findings.
Quarantine outside files. Open studies from outside your modalities in a constrained account until the viewer is current.
Fuzz the parser. If you ship a DICOM parser, fuzz it against malformed files; repeat findings in one class point to systemic parser weakness.

Sources

Questions & Answers

What are the Sante DICOM Viewer Pro advisories?

Two in three months: ICSMA-25-079-01 in March 2025, an out-of-bounds write (CVE-2025-2480, 7.8), and ICSMA-25-148-01 in May, an out-of-bounds read (CVE-2025-5307). Michael Heinzl reported both.

How would an attacker trigger the Sante viewer bugs?

By getting a user to open a crafted DCM file. In the out-of-bounds write case, memory corruption is a path to code execution on the imaging workstation.

← Back to Vulnerabilities