ICSMA-25-128-01: Pixmeo OsiriX MD

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause memory corruption, resulting in a denial-of-service condition or to steal credentials. CVE-2025-27578: The affected product is vulnerable to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory corruption leading to a denial-of-service condition. CVE-2025-31946: The affected product is vulnerable to a local use after free scenario, which could allow an attacker to locally import a crafted DICOM file and cause memory corruption or a system crash. CVE-2025-27720: The Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.

Advisory Details CISA ICS CSAF feed

Advisory ID: ICSMA-25-128-01
Status: Final · version 1
Initial release: 2025-05-08
Last revised: 2025-05-08
Vendor: Pixmeo
Critical infrastructure sectors: Healthcare and Public Health
Deployed: Worldwide
Vendor headquarters: Switzerland

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Do not click web links or open attachments in unsolicited email messages.

Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.

Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

Credit: Chizuru Toyama, Canaan Kao (TXOne Networks)

Affected products (1)

OsiriX MD — <=14.0.1_Build_2024-02-28

From CISA's machine-readable CSAF 2.0 advisory (JSON).

Vulnerabilities as Stated by the Advisory

CVE	Weakness	CVSS v3	Details
CVE-2025-27578	CWE-416 Use After Free	7.5 High	The affected product is vulnerable to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory corruption leading to a denial-of-service condition. Vendor fix: Pixmeo recommends users to download the latest version of OsiriX MD. ↗ Vendor fix: For additional support regarding OsiriX MD, users should contact Pixmeo directly. ↗ Affected, fixed & timeline Affected: OsiriX MD <=14.0.1_Build_2024-02-28
CVE-2025-27720	CWE-319 Cleartext Transmission of Sensitive Information	7.4 High	The Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials. Vendor fix: Pixmeo recommends users to download the latest version of OsiriX MD. ↗ Vendor fix: For additional support regarding OsiriX MD, users should contact Pixmeo directly. ↗ Affected, fixed & timeline Affected: OsiriX MD <=14.0.1_Build_2024-02-28
CVE-2025-31946	CWE-416 Use After Free	6.2 Medium	The affected product is vulnerable to a local use after free scenario, which could allow an attacker to locally import a crafted DICOM file and cause memory corruption or a system crash. Vendor fix: Pixmeo recommends users to download the latest version of OsiriX MD. ↗ Vendor fix: For additional support regarding OsiriX MD, users should contact Pixmeo directly. ↗ Affected, fixed & timeline Affected: OsiriX MD <=14.0.1_Build_2024-02-28

Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2025-27720	9.3 Critical	Pixmeo OsiriX MD The Pixmeo Osirix MD Web Portal sends credential information without encryption, which could allow an attacker to steal credentials.
CVE-2025-27578	8.7 High	Pixmeo OsiriX MD Pixmeo OsiriX MD is vulnerable to a use after free scenario, which could allow an attacker to upload a crafted DICOM file and cause memory corruption…
CVE-2025-31946	6.9 Medium	Pixmeo OsiriX MD Pixmeo OsiriX MD is vulnerable to a local use after free scenario, which could allow an attacker to locally import a crafted DICOM file and cause me…

Named by the advisory itself. Each CVE links to its tracked detail page.

Vendors Named in This Publication

No KEV-catalogued vendors are named in this publication.

CyberzSOC