CVE-2025-2480
📋 TL;DR
Santesoft Sante DICOM Viewer Pro contains an out-of-bounds write vulnerability that allows local attackers to execute arbitrary code by tricking users into opening malicious DCM files. This affects healthcare organizations and medical imaging professionals using this software for viewing medical images. The vulnerability requires user interaction but can lead to complete system compromise.
💻 Affected Systems
- Santesoft Sante DICOM Viewer Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with administrative privileges, data theft, ransomware deployment, and lateral movement within healthcare networks.
Likely Case
Local privilege escalation leading to data exfiltration of sensitive medical images and patient information, or installation of persistent malware.
If Mitigated
Limited impact due to application sandboxing, restricted user privileges, and network segmentation preventing lateral movement.
🎯 Exploit Status
Exploitation requires social engineering to get user to open malicious DCM file. No authentication bypass needed once file is opened.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific version
Vendor Advisory: https://santesoft.com/win/sante-dicom-viewer-pro/download.html
Restart Required: No
Instructions:
1. Visit Santesoft website 2. Download latest version 3. Install update 4. Verify installation
🔧 Temporary Workarounds
Restrict DCM file handling
WindowsConfigure system to open DCM files with alternative, secure software
User awareness training
allTrain users to only open DCM files from trusted sources
🧯 If You Can't Patch
- Implement application whitelisting to prevent unauthorized code execution
- Run software with least privilege user accounts, not administrative rights
🔍 How to Verify
Check if Vulnerable:
Check software version against vendor advisory. If using any version before the patched release, system is vulnerable.Check Version:
Open Sante DICOM Viewer Pro → Help → About to view versionVerify Fix Applied:
Verify software version matches or exceeds patched version specified in vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Application crashes when opening DCM files
- Unusual process spawning from Sante DICOM Viewer
Network Indicators:
- Outbound connections from Sante DICOM Viewer to unknown IPs
- Unusual data exfiltration patterns
SIEM Query:
Process: 'SanteDICOMViewer.exe' AND (EventID: 1000 OR EventID: 1001) OR Network: SourceIP contains workstation AND DestinationIP not in allowed_medical_servers