DICOM, Digital Imaging and Communications in Medicine, had a high-severity vulnerability discovered in its MicroDicom DICOM Viewer, which is a free software program used to view and manipulate DICOM medical images.
A threat actor can exploit the vulnerability remotely even with a low complexity attack. If the exploitation is successful, the attacker can execute arbitrary code on vulnerable DICOM Viewer. To proceed with the vulnerability exploitation, user interaction is necessary, which means, the threat actor must lead a user to click a malicious DICOM file locally or go to a malicious web page. This can be achieved by means of phishing or social engineering attack.
Vulnerability CVE-2025-5943 impacts DICOM Viewer version 2025.2 (Build 8154) and earlier versions. The vulnerability is described as an out-of-range write issue. It means that the threat actor can write to memory beyond the boundaries of the supposed buffer and implement arbitrary code. The vulnerability is given a CVSS v3.1 base score of 8.8 out of 10 and a CVSS v4 base rating of 8.6 out of 10. Although there were no identified instances of vulnerability exploitation in the wild during the announcement, it is recommended to apply patching immediately. DICOM already fixed the vulnerability in version 2025.3 and more recent versions.
Independent security researcher Michael Heinzl discovered the vulnerability and reported it to the U.S. Cybersecurity and Infrastructure Agency (CISA). DICOM reported other vulnerabilities before this latest report as follows:
- Two high-severity vulnerabilities in May 2025,
- a medium-severity vulnerability in February 2025, which can be exploited in a machine-in-the-middle (MitM) attack
- Four high-severity vulnerabilities were discovered in 2024 and announced in March and June 2024
Because HIPAA-certified DICOM often identifies vulnerabilities, it is recommended that DICOM Viewer be protected with a firewall and separated from business systems. In case remote access is necessary, DICOM should use a secure connection like a Virtual Private Network (VPN) and ensure that the VPN is updated.
