Arbitrary Code Execution Vulnerability in Sante DICOM Viewer Pro by Sante Group

CVE-2022-28668

What is CVE-2022-28668?

A vulnerability in Sante DICOM Viewer Pro 11.9.2 allows remote attackers to execute arbitrary code on installations by exploiting a flaw in the parsing of J2K files. The issue arises from inadequate validation of user-supplied data, which can lead to a write past the end of an allocated data structure. This requires user interaction; the target must visit a malicious webpage or open a malicious file to activate the exploit. Successful exploitation allows an attacker to run code within the context of the current process, posing significant security risks.

References