Cyber Posture

CVE-2025-2581

Medium

Published: 21 March 2025

Published
21 March 2025
Modified
03 November 2025
KEV Added
Patch
CVSS Score 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
EPSS Score 0.0012 29.8th percentile
Risk Priority 9 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Security Summary

CVE-2025-2581 is an integer underflow vulnerability (CWE-189, CWE-191) affecting the malloc function in the DICOM File Handler component of xmedcon version 0.25.0. Published on 2025-03-21, it carries a CVSS v3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), indicating medium severity with potential for limited disruption.

An unauthenticated attacker can exploit this remotely by supplying a malicious DICOM file that triggers the underflow during processing. Exploitation requires user interaction, such as opening the file in xmedcon, and results in a denial-of-service condition through application crash, with no impact on confidentiality or integrity.

Advisories recommend upgrading to xmedcon version 0.25.1 to remediate the issue. Details are documented in VulDB entries (ctiid.300541, id.300541, submit.522216), the xmedcon project release notes, and a Debian LTS announcement.

Details

CWE(s)
CWE-189CWE-191

Affected Products

xmedcon project
xmedcon
0.25.0

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Why these techniques?

The integer underflow vulnerability (CWE-191) in xmedcon's DICOM file handler causes memory corruption (SIGBUS), enabling remote exploitation of client-side software for code execution (T1203) or denial-of-service via crash (T1499.004) when a user processes a malformed DICOM file.

References