CVE-2025-27578

HIGH

Pixmeo OsiriX MD < 14.0.1 - Use-After-Free via Crafted DICOM File

Title source: llm

Description

Pixmeo OsiriX MD is vulnerable to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory corruption leading to a denial-of-service condition.

References (3)

Core 3

Core References

Various Sources

https://www.osirix-viewer.com/osirix/osirix-md/

Various Sources

https://www.osirix-viewer.com/about/contact/

Third Party Advisory, US Government Resource

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01

Scores

CVSS v3 7.5

EPSS 0.0079

EPSS Percentile 51.3%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-416

Status published

Products (1)

Pixmeo/OsiriX MD < 14.0.1

Published May 08, 2025

Tracked Since Feb 18, 2026