CVE-2025-3481
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on MedDream PACS Server installations without authentication by sending specially crafted DICOM files. The stack-based buffer overflow occurs during DICOM file parsing due to insufficient length validation. All systems running vulnerable versions of MedDream PACS Server are affected.
💻 Affected Systems
- MedDream PACS Server
📦 What is this software?
Pacs Server by Meddream
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining service account privileges, potentially leading to data theft, system destruction, or lateral movement within the network.
Likely Case
Remote code execution allowing attackers to install malware, exfiltrate sensitive medical data, or disrupt PACS operations.
If Mitigated
Limited impact if proper network segmentation and access controls prevent exploitation attempts from reaching vulnerable systems.
🎯 Exploit Status
No authentication required and stack-based buffer overflow typically has low exploitation complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific patched version
Vendor Advisory: https://www.zerodayinitiative.com/advisories/ZDI-25-245/
Restart Required: Yes
Instructions:
1. Check current MedDream PACS Server version
2. Download and apply vendor patch
3. Restart MedDream PACS Server service
4. Verify patch application
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to MedDream PACS Server to only trusted sources
DICOM File Validation
allImplement external DICOM file validation/sanitization before processing
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Deploy intrusion detection/prevention systems to monitor for exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check MedDream PACS Server version against vendor advisory for affected versionsCheck Version:
Check MedDream administration interface or installation documentation for version informationVerify Fix Applied:
Verify MedDream PACS Server version matches or exceeds patched version from vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unusual DICOM file processing errors
- Service crashes or restarts
- Unusual network connections from PACS server
Network Indicators:
- Malformed DICOM file transfers to PACS server
- Unexpected outbound connections from PACS server
SIEM Query:
source="meddream_pacs" AND (event_type="crash" OR event_type="buffer_overflow")