CVE-2024-22100
MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.26%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.26% probability · 18th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-122, CWE-787
- Affected
- microdicom/dicom viewer
- Source
- ics-cert@hq.dhs.gov
References
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01US Government Resource
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.