Read the docs
TI-2025-03061 Aliases CVE-2025-3483GHSA-47j8-fw62-838j

Stack-based buffer overflow in MedDream PACS Server

Priority MEDIUM 43CWE-121Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

MedDream PACS Server DICOM File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MedDream PACS Server. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of DICOM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-25825.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00625 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MedDreamPACS ServerMedDream PACS Premium 7.3.3.840—No fix listedCNA
  • PACS Server VendorMedDream Affected MedDream PACS Premium 7.3.3.840 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:meddream:pacs_server:*:*:*:*:premium:*:*:*before 7.3.5.860VulnerableMedDream
  • cpe:2.3:a:meddream:pacs_server:*:*:*:*:premium:*:*:* Versions before 7.3.5.860 Vulnerable ·MedDream

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3483
  2. 2026-10-03 Alias added: GHSA-47j8-fw62-838j
  3. 2026-11-03 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2025-35927 Cross-site scripting in MedDream PACS Premium CVSS 3.1MEDIUM 6.1
  • TI-2025-03062 Stack-based buffer overflow in MedDream PACS Server CVSS 3.0CRITICAL 9.8
  • TI-2025-33783 An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of… CVSS 3.1CRITICAL 9.6
  • TI-2025-20518 Improper access control in MedDream PACS Premium CVSS 3.1CRITICAL 9.8
  • TI-2025-19417 Incorrect permission assignment in MedDream PACS Premium CVSS 3.1CRITICAL 9.8
  • TI-2025-18208 Server-side request forgery in MedDream PACS Premium CVSS 3.1HIGH 7.5
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences