Santesoft Releases Security Update for Sante DICOM Viewer Pro
CVE-2025-5307 could allow a local attacker to disclose sensitive information or execute arbitrary code
Summary
CVE-2025-5307 could allow a local attacker to disclose sensitive information or execute arbitrary code
Affected platforms
The following platforms are known to be affected:
Threat details
Introduction
The US Cybersecurity and Infrastructure Security Agency (CISA) has released an Industrial Control Systems (ICS) Medical Advisory for a vulnerability in Santesoft Sante DICOM Viewer Pro. Sante DICOM Viewer Pro is an application for viewing, processing, and editing DICOM-format medical images.
CVE-2025-5307 has a CVSSv4 score of 8.4 and is an 'out-of-bounds read' vulnerability, which means that the product reads data past the end, or before the beginning, of the intended memory buffer. A local attacker could exploit this vulnerability to disclose sensitive information or execute arbitrary code. Active user interaction is required for successful exploitation.
Remediation advice
Affected organisations are encouraged to review CISA advisory ICSMA-25-148-01 and update Sante DICOM Viewer Pro to version 14.2.2 or higher.
Definitive source of threat updates
Last edited: 30 May 2025 11:00 am