CVE-2024-22100 - Vulnerability Details - OpenCVE

MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0004.

Key SSVC decision points have not yet been added.

Vendors	Products
Microdicom	Dicom Viewer

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Microdicom	Dicom Viewer

Advisories

Source	ID	Title
EUVD	EUVD-2024-19696	MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.

Fixes

Solution

MicroDicom has provided a fix and recommends users upgrade to 2024.1 https://www.microdicom.com/ . For additional assistance, contact MicroDicom https://www.microdicom.com/contacts.html directly

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2024-03-01T00:37:47.300Z

Updated: 2024-08-12T20:20:19.945Z

Reserved: 2024-02-12T16:22:12.768Z

Link: CVE-2024-22100

Vulnrichment

Updated: 2024-08-01T22:35:34.715Z

NVD

Status : Awaiting Analysis

Published: 2024-03-01T01:15:07.330

Modified: 2024-11-21T08:55:35.003

Link: CVE-2024-22100

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-07-13T21:07:43Z

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-22100", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "state": "PUBLISHED", "assignerShortName": "icscert", "dateReserved": "2024-02-12T16:22:12.768Z", "datePublished": "2024-03-01T00:37:47.300Z", "dateUpdated": "2024-08-12T20:20:19.945Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "DICOM Viewer", "vendor": "MicroDicom", "versions": [{"lessThanOrEqual": " 2023.3 (Build 9342)", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Michael Heinzl reported these vulnerabilities to CISA."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.</span>\n\n</span>\n\n</span>\n\n"}], "value": "\n\n\n\n\nMicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.\n\n\n\n\n\n"}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-03-01T00:41:25.917Z"}, "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\n<p>MicroDicom has provided a fix and recommends users upgrade to <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.microdicom.com/\">2024.1</a>.</p><p>For additional assistance, <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.microdicom.com/contacts.html\">contact MicroDicom</a> directly</p>\n\n<br>"}], "value": "\nMicroDicom has provided a fix and recommends users upgrade to 2024.1 https://www.microdicom.com/ .\n\nFor additional assistance, contact MicroDicom https://www.microdicom.com/contacts.html \u00a0directly\n\n\n\n\n"}], "source": {"discovery": "EXTERNAL"}, "title": "MicroDicom DICOM Heap-based Buffer Overflow", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.715Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "microdicom", "product": "dicom_viewer", "cpes": ["cpe:2.3:a:microdicom:dicom_viewer:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2023.3_build_9342", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-03-04T20:39:49.457575Z", "id": "CVE-2024-22100", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T20:20:19.945Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T22:35:34.715Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-22100", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-03-04T20:39:49.457575Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:microdicom:dicom_viewer:*:*:*:*:*:*:*:*"], "vendor": "microdicom", "product": "dicom_viewer", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2023.3_build_9342"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-12T20:20:12.261Z"}}], "cna": {"title": "MicroDicom DICOM Heap-based Buffer Overflow", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Michael Heinzl reported these vulnerabilities to CISA."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MicroDicom", "product": "DICOM Viewer", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": " 2023.3 (Build 9342)"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "\nMicroDicom has provided a fix and recommends users upgrade to 2024.1 https://www.microdicom.com/ .\n\nFor additional assistance, contact MicroDicom https://www.microdicom.com/contacts.html \u00a0directly\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<p>MicroDicom has provided a fix and recommends users upgrade to <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.microdicom.com/\">2024.1</a>.</p><p>For additional assistance, <a target=\"_blank\" rel=\"nofollow\" href=\"https://www.microdicom.com/contacts.html\">contact MicroDicom</a> directly</p>\n\n<br>", "base64": false}]}], "references": [{"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-24-060-01"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\n\n\n\n\nMicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.\n\n\n\n\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">MicroDicom DICOM Viewer versions 2023.3 (Build 9342) and prior are affected by a heap-based buffer overflow vulnerability, which could allow an attacker to execute arbitrary code on affected installations of DICOM Viewer. A user must open a malicious DCM file in order to exploit the vulnerability.</span>\n\n</span>\n\n</span>\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2024-03-01T00:41:25.917Z"}}}, "cveMetadata": {"cveId": "CVE-2024-22100", "state": "PUBLISHED", "dateUpdated": "2024-08-12T20:20:19.945Z", "dateReserved": "2024-02-12T16:22:12.768Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2024-03-01T00:37:47.300Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}