Deserialization Vulnerability in Medtronic MyCareLink Patient Monitor

CVE-2025-4393

What is CVE-2025-4393?

The Medtronic MyCareLink Patient Monitor is susceptible to a deserialization vulnerability due to its internal service that handles data deserialization. A local attacker may exploit this flaw by creating a specially crafted binary payload, allowing them to crash the service or potentially elevate their privileges. This vulnerability affects specific models 24950 and 24952, putting patient data and device functionality at risk. Remediation steps and further details are available on the Medtronic product security bulletin.

References