Critical Security Flaws in MicroDicom DICOM Viewer Threaten Medical Data & Patient Safety

When exploring the latest security advisory for the MicroDicom DICOM Viewer, it is evident that even widely trusted imaging software within healthcare can harbor significant vulnerabilities, threatening both patient safety and the integrity of medical systems worldwide. In the midst of escalating cybersecurity threats to healthcare infrastructure, the implications of these findings echo well beyond IT departments—they actively shape how medical professionals must think about the tools on which they depend daily.

Unpacking the Advisory: What Happened?​

According to a publication by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), MicroDicom DICOM Viewer, a popular piece of software for viewing DICOM (Digital Imaging and Communications in Medicine) files, is affected by two major vulnerabilities—out-of-bounds write (CWE-787) and out-of-bounds read (CWE-125). The affected versions are 2025.1 (Build 3321) and all prior releases. Both vulnerabilities carry a high severity CVSS v4 base score of 8.6, meaning they are considered critical risks for organizations relying on this software in clinical settings.
Importantly, Michael Heinzl, the researcher who reported these issues to CISA, highlights that successful exploitation of either flaw requires the victim to open a specially crafted, malicious DCM file using the affected viewer. Once exploited, attackers could gain access to sensitive data (information disclosure), corrupt the system’s memory, or—most alarmingly—execute arbitrary code, potentially taking control of the impacted device.

Why DICOM Viewer Security Matters​

DICOM is the de facto standard for handling, storing, transmitting, and displaying medical imaging information. Its widespread adoption means vulnerability in any DICOM-compliant tool can introduce systemic risks to a hospital’s digital workflow, including radiology diagnostics, telemedicine, and remote consultation networks.
Hospitals and clinics across the world utilize MicroDicom due to its reputation for intuitive usability, robust feature set, and cost-effectiveness. Software of this nature typically operates at the heart of sensitive medical infrastructure, often within networks designed to be isolated but, in practice, sometimes inadvertently exposed.

Understanding the Vulnerabilities​

Out-of-Bounds Write (CVE-2025-35975 | CWE-787)​

An out-of-bounds write occurs when software writes data past the end or before the beginning of the intended buffer. For MicroDicom DICOM Viewer, this means that if a user opens a malicious DICOM file, the attacker may overwrite key sections of memory. The result? Memory corruption, which can be harnessed to execute malicious code under the user’s privileges. Such control could be leveraged for data exfiltration, deployment of ransomware, or even using the compromised system as a springboard into wider hospital networks.
The technical details, as verified by CISA and corroborated by the Common Vulnerabilities and Exposures database, assign this vulnerability a CVSS v3.1 score of 8.8 (vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), confirming its potential impact across confidentiality, integrity, and availability metrics.

Out-of-Bounds Read (CVE-2025-36521 | CWE-125)​

Similar in nature but typically considered slightly less severe, an out-of-bounds read vulnerability allows attackers to read data outside of the intended boundaries. Although this may “merely” cause application instability or crashes in benign scenarios, when security boundary assumptions are broken, it may allow the exposure of memory contents, including sensitive patient information or cryptographic materials.
This weakness carries the same CVSS scores as the out-of-bounds write, reflecting a high likelihood of memory corruption and potential data leakage. In a healthcare environment, even small leaks can result in costly, reportable HIPAA violations and lasting reputational harm.

Who Is Affected and How?​

Every healthcare provider, imaging lab, and connected facility using MicroDicom DICOM Viewer up to version 2025.1 is vulnerable if they are not running the patched release. The vulnerability assessment notes that the exploitation requires user interaction: specifically, an innocent staff member must open a compromised DICOM file. Thus, an attack could be initiated via targeted phishing, internal spear-phishing, or by feeding booby-trapped files into shared workflow folders.
The risk is heavily amplified in environments where DICOM files are routinely exchanged between disparate organizations, external imaging providers, or cloud-based PACS (Picture Archiving and Communication System) platforms.

The Scope: Healthcare's Unique Vulnerability​

The importance of DICOM viewer security cannot be overstated in the context of critical infrastructure, especially as healthcare increasingly relies on digital technologies. As CISA notes, these vulnerabilities have global reach, with deployments in hospitals and clinics on every continent.
The software’s home base, Bulgaria, is indicative of the international nature of medical IT supply chains. Problems originating from a single vendor can ripple quickly into patient care worldwide, especially when a product rises to prominence in the open-source or freeware ecosystem.

How Widespread Is MicroDicom?​

While specific deployment figures aren’t available from the vendor’s own disclosures, analysts and industry surveys indicate that MicroDicom remains one of the most accessible and frequently downloaded DICOM viewers globally. It is particularly popular within smaller clinics, educational institutions, and resource-constrained environments, thanks to its freeware model and broad compatibility with Windows OS, including legacy systems.
Relevant third-party software tracking platforms report millions of downloads and frequent positive endorsements on radiology forums. As such, the potential attack surface is significant—particularly in environments with inadequate patch-management protocols.

Mitigation: What Should Users Do?​

MicroDicom has responded promptly, issuing version 2025.2 and advising all users to immediately update their software. This release reportedly addresses both vulnerabilities—users can obtain the latest version from the official MicroDicom download portal.
CISA and cybersecurity specialists reinforce the following best practices for all organizations:

• Do not expose control systems to the wider Internet. Network isolation remains one of the most effective means to minimize risk.
• Deploy firewalls and segment medical imaging devices and PACS from business networks. Restricting lateral movement limits the blast radius of an exploit.
• Use secure remote access tools (preferably with multi-factor authentication), and keep VPNs patched to the newest versions.
• Regularly train staff on the dangers of spear-phishing and social engineering. Because exploitation still requires an initial click, well-informed users are a vital defense layer.
• Review logs and monitor for unusual DICOM file activity. Effective incident response depends on detection.
• Report suspected exploitation to national authorities like CISA.

CISA maintains an arsenal of defensive resources, including technical whitepapers and alerts, for organizations eager to go beyond basic IT hygiene. Materials such as “Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies” and “Cybersecurity Best Practices for Industrial Control Systems” provide actionable guides tailored for healthcare infrastructure.

Technical Analysis: Why Are Such Flaws Still Prevalent?​

Memory management flaws, such as out-of-bounds writes and reads, consistently rank among the most hazardous vulnerabilities in all forms of software. Despite decades of experience—along with modern languages and mitigations—legacy code and performance-oriented C/C++ bases persist in healthcare imaging applications.
The very nature of parsing large, heterogeneous medical images increases complexity: DICOM is a versatile standard, encompassing not just raw pixel data but extensive metadata, embedded documents, and even executable scripts in rarer cases. This complex attack surface makes robust input validation crucial, but also genuinely challenging.
Moreover, the highly interconnected—yet resource-strained—nature of healthcare IT means many organizations still use older software on untended endpoints, worsening the risk landscape.

Potential Impact Scenarios​

Patient Data Breach​

The most obvious threat is the silent reading of confidential patient records, leading to identity theft, insurance fraud, or public disclosure. Out-of-bounds reads could theoretically expose cached, unencrypted patient data.

Ransomware Entry Point​

Memory corruption and code execution are often preludes to ransomware deployment. An attacker could compromise a radiologist’s workstation and move laterally into connected PACS servers, seeking ransom payments to restore access.

Supply Chain Compromise​

If a software update is not applied universally, attackers could target vulnerable endpoints within interconnected research networks, propagating exploits into hospital supply chains or research collaborations.

Service Disruption​

Out-of-bounds memory flaws can destabilize applications, potentially causing crashes at moments of peak clinical activity—delaying care or forcing manual workarounds when seconds matter.

Notable Strengths: The Industry Response​

On the positive side, MicroDicom’s rapid response and transparent mitigation efforts stand out. Releasing a fixed version within a narrow window demonstrates a commitment to product security. Additionally, CISA’s coordination and publication ensure that stakeholders are promptly informed—a best practice all vendors should emulate.
The reliance on CVSS scoring and full vector transparency aids IT managers in risk assessment and prioritization. Publicly crediting the independent researcher, Michael Heinzl, underlines the importance of responsible disclosure and the growing role of external security researchers in protecting critical public infrastructure.

Risks and Lingering Concerns​

Patch Gaps​

A recurring problem in healthcare is delayed patching. Even when updates are made available, overtasked IT departments and reliance on older imaging hardware (which may not support newer software) often slows adoption. This creates a dangerous window between publication and full deployment.

Social Engineering​

As with many vulnerabilities requiring a user to open a malicious file, end-user vigilance is paramount. Sophisticated phishing attacks normalized by current threat actors could trick even tech-savvy professionals, especially in high-pressure clinical environments.

Unknown Exploit Variants​

While no public exploitation has so far been reported to CISA, the attack path is well-understood within the security community. Similar vulnerabilities have played a role in high-profile ransomware and espionage campaigns targeting healthcare institutions globally. The absence of public exploits should not be misconstrued as absence of risk.

Legacy Systems and Compatibility Woes​

Healthcare organizations with mission-critical legacy systems—sometimes isolated for regulatory reasons—may be unable to update quickly or at all. Unsupported operating systems or integration with specialist medical hardware may require bespoke remediation, further complicating the cycle of securing the attack surface.

The Broader Picture: Medical Imaging Security​

This incident must be seen alongside ongoing threats to medical imaging—from vendor-specific flaws (such as in Siemens and GE devices) to generic DICOM specification issues (e.g., lack of encryption by default or insufficient authentication measures in early implementations).
Industry groups and regulatory agencies are steadily moving toward more secure-by-design imaging workflows, advocating for end-to-end encryption, digital signing of images, and robust authentication for PACS access. The exposure of flaws in key freeware viewers is a stark reminder that every link in the imaging chain matters.

Conclusion: Security Is Never “Set and Forget”​

The MicroDicom DICOM Viewer vulnerabilities highlight the delicate balance between functional usability and security in healthcare IT. As digital health matures, the need for rapid vendor response, comprehensive patching, and frontline staff awareness becomes non-negotiable.
Every organization running diagnostic imaging software—regardless of size or geography—should verify they are running MicroDicom DICOM Viewer v2025.2 or later and review their existing security perimeter in light of the latest guidance.
Ultimately, the collaborative synergy of vendors, security researchers, IT teams, and national cyber defense authorities remains our strongest defense in a medical world increasingly defined by the integrity of its data—and the resilience of its practitioners. As the digital fabric of healthcare continues to expand, so too must our commitment to its protection.

---

For more details, CISA’s official advisory on MicroDicom DICOM Viewer provides the source documentation and ongoing updates as new information emerges.

---

Source: CISA MicroDicom DICOM Viewer | CISA