{"id":"CVE-2025-5943","state":"PUBLISHED","title":"MicroDicom DICOM Viewer Out-of-bounds Write","description":"MicroDicom \n\nDICOM Viewer suffers from an out-of-bounds write vulnerability. Remote attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit the vulnerability in that the user must either visit a malicious website or open a malicious DICOM file locally.","publishedAt":"2025-06-10T17:42:33.029Z","updatedAt":"2025-06-11T14:39:58.540Z","severity":{"score":8.6,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"icscert"},"assigner":"icscert","products":["MicroDicom DICOM Viewer"],"affected":[{"vendor":"MicroDicom","product":"DICOM Viewer","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2025.2 (Build 8154)","versionType":"custom"}]}],"references":["https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-160-01"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:09:39.787Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/5xxx/CVE-2025-5943.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-5943","state":"PUBLISHED","datePublished":"2025-06-10T17:42:33.029Z","dateUpdated":"2025-06-11T14:39:58.540Z","assignerShortName":"icscert","assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateReserved":"2025-06-09T16:39:58.384Z"},"containers":{"cna":{"title":"MicroDicom DICOM Viewer Out-of-bounds Write","descriptions":[{"lang":"en","value":"MicroDicom \n\nDICOM Viewer suffers from an out-of-bounds write vulnerability. Remote attackers are able to exploit this issue to potentially execute arbitrary code on affected installations of DICOM Viewer. User interaction is required to exploit the vulnerability in that the user must either visit a malicious website or open a malicious DICOM file locally."}],"affected":[{"vendor":"MicroDicom","product":"DICOM Viewer","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2025.2 (Build 8154)","versionType":"custom"}]}],"references":[{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-160-01"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.6,"baseSeverity":"HIGH","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"ACTIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","description":"CWE-787 Out-of-bounds Write","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"icscert","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","dateUpdated":"2025-06-10T17:42:33.029Z"},"credits":[{"lang":"en","type":"finder","value":"Michael Heinzl reported this vulnerability to CISA."}],"datePublic":"2025-06-10T17:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span style=\"background-color: rgb(255, 255, 255);\">MicroDicom recommends users update DICOM Viewer to version </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.microdicom.com/downloads.html\">2025.3</a><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;or later.</span>\n\n<br>"}],"value":"MicroDicom recommends users update DICOM Viewer to version  2025.3 https://www.microdicom.com/downloads.html  or later."}],"source":{"advisory":"ICSMA-25-160-01","discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-11T14:39:51.039611Z","id":"CVE-2025-5943","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-11T14:39:58.540Z"}}]}}}