PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-27578 Pixmeo CVE debrief

CVE-2025-27578 affects Pixmeo OsiriX MD and was published by CISA on 2025-05-08. The advisory says a crafted DICOM file can trigger a use-after-free condition, leading to memory corruption and a denial-of-service impact. The issue is scored CVSS 7.5 (HIGH) with availability impact only. Pixmeo recommends updating to the latest version of OsiriX MD.

Vendor
Pixmeo
Product
OsiriX MD
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-05-08
Original CVE updated
2025-05-08
Advisory published
2025-05-08
Advisory updated
2025-05-08

Who should care

Hospitals, clinics, and imaging teams that use Pixmeo OsiriX MD; endpoint and application security teams responsible for medical imaging software; and IT staff managing DICOM upload workflows or systems exposed to untrusted file intake.

Technical summary

The source advisory describes a use-after-free vulnerability in OsiriX MD. An attacker who can upload a crafted DICOM file may trigger memory corruption and crash the application, causing denial of service. The supplied CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network-reachable attack with no privileges or user interaction required and high availability impact.

Defensive priority

High

Recommended defensive actions

  • Install the latest version of OsiriX MD from Pixmeo as soon as possible.
  • Inventory all OsiriX MD deployments and confirm which systems are exposed to DICOM file uploads or other untrusted input paths.
  • Limit access to DICOM upload and ingestion workflows to trusted users and trusted network segments where feasible.
  • Monitor for crashes, memory faults, or repeated service restarts in affected imaging workflows.
  • Contact Pixmeo directly if you need vendor support or clarification about remediation.

Evidence notes

Primary facts come from the CISA CSAF advisory for CVE-2025-27578 and its associated references. The advisory states the flaw is a use-after-free that can be triggered by a crafted DICOM file, causing memory corruption and denial of service. The advisory also provides the vendor remediation to download the latest version of OsiriX MD. The CVE and advisory were published and last modified on 2025-05-08; no KEV entry was provided in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-27578 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-27578

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-27578 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-27578

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsma-25-128-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-128-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.