The vulnerability is a classic buffer overflow in the DCM file parser that allows a remote attacker to execute arbitrary code in the context of the running process. Because the input length is not validated before copying, an attacker can craft a malicious file and trigger the overflow, leading to full remote code execution.

The flaw affects all installations of Sante DICOM Viewer Pro. The product name is Sante DICOM Viewer Pro, but the CVE data does not specify vulnerable versions, so all supported releases should be considered at risk until a vendor update is released.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests low probability of widespread exploitation at present. Nevertheless, the vulnerability is not listed in the CISA KEV catalog, and exploitation requires user interaction: the target must open a malicious DCM file or visit a malicious page that triggers the parser. Once exploited, the attacker can run arbitrary code with the privileges of the current process.