Two rounds of memory-corruption bugs in one DICOM viewer

Santesoft Sante DICOM Viewer Pro drew two advisories in three months. ICSMA-25-079-01 in March, an out-of-bounds write, CVE-2025-2480 at 7.8. Then ICSMA-25-148-01 in May, an out-of-bounds read, CVE-2025-5307. Michael Heinzl reported both.

Out-of-bounds reads and writes belong to the family of memory-safety defects that appear when software copies or indexes data without first confirming it fits the buffer set aside for it. Image and file parsers are fertile ground for them because a format like DICOM carries many length fields, offsets and nested structures, each one trusted to describe the bytes that follow. A single malformed value can steer the reader past the end of its allocation.

The two findings differ in a way that matters to a defender. An out-of-bounds read can leak whatever sits in adjacent memory, while an out-of-bounds write can corrupt program state and, in the worst case, let an attacker redirect execution. On a radiology workstation that opens studies arriving from many sources, either outcome puts the machine reading diagnostic images at the mercy of the file it was asked to display.

Open a crafted DCM file, corrupt memory, and in the write case that is a path to code execution on the workstation. When one memory-corruption bug turns up in a file parser, more are usually nearby, because the code was written without a hostile-input mindset throughout. A single fuzzing campaign against the DICOM parser would likely have surfaced both, and that campaign is cheaper than two advisories.

Advisories landing a few months apart also show how researchers work a promising target. Code that yields one memory-corruption bug invites a closer look, and the same investigator often returns with fresh test cases against the same parser. For imaging departments the practical effect is a widely used viewer that needed attention twice in a single season, a rhythm that wears on teams already stretched by the volume of medical-device advisories.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

CISA hit Sante DICOM Viewer Pro twice in 2025, an out-of-bounds write (ICSMA-25-079-01) and later an out-of-bounds read (ICSMA-25-148-01), both triggered by opening a crafted file. Update to the current version and handle outside DICOM files as untrusted input.

Update to the current release. Apply the latest Sante DICOM Viewer Pro version that closes both findings.
Quarantine outside files. Open studies from outside your modalities in a constrained account until the viewer is current.
Fuzz the parser. If you ship a DICOM parser, fuzz it against malformed files; repeat findings in one class point to systemic parser weakness.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

app_file_upload parse_image

Contributing

sys_ots_software use_hospital_net data_phi net_remote_access

EMB3D

PID-3122

Fix the class in your product

A crafted file drives the parser out of bounds. As the maker, validate every length and offset against the real buffer before you copy, decode in a sandboxed least-privilege process, and fuzz the path continuously so the next bug is yours to find.

Bound every copy. Check declared sizes against allocated buffers before memcpy; prefer memory-safe parsers for new work.
Sandbox the decoder. Run it least-privilege and isolated so a crash or exploit is contained, not privileged.
Fuzz as a release gate. Run malformed-input fuzzing on every file-format parser before shipping.

Mapped EMB3D mitigations

Questions & Answers

What are the Sante DICOM Viewer Pro advisories?

Two in three months: ICSMA-25-079-01 in March 2025, an out-of-bounds write (CVE-2025-2480, 7.8), and ICSMA-25-148-01 in May, an out-of-bounds read (CVE-2025-5307). Michael Heinzl reported both.

How would an attacker trigger the Sante viewer bugs?

By getting a user to open a crafted DCM file. In the out-of-bounds write case, memory corruption is a path to code execution on the imaging workstation.

← Back to Vulnerabilities