Remote Code Execution in Sante DICOM Viewer Pro by Devicetree
CVE-2022-24059

7.8HIGH

Key Information:

Vendor

Sante

Status
Dicom Viewer Pro
Vendor
CVE Published:
18 February 2022

What is CVE-2022-24059?

This vulnerability allows remote attackers to execute arbitrary code on installations of Sante DICOM Viewer Pro 11.8.7.0 through the manipulation of DCM files. To exploit this flaw, a user must be tricked into visiting a malicious page or opening a specially crafted DCM file, which can lead to a write past the end of an allocated buffer. If successful, the attacker can run code in the context of the current process, posing significant security risks to users.

Affected Version(s)

DICOM Viewer Pro 11.8.7.0

References

https://www.zerodayinitiative.com/advisories/ZDI-22-251/
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mat Powell of Trend Micro Zero Day Initiative
JSON
.