CVE-2023-34296 is an out-of-bounds write in the DCM file parser of Sante DICOM Viewer Pro, scored 8.8 High by NVD. It is a separate case from CVE-2023-34295, with its own ZDI advisory. ZDI says version 12.2.4 fixes it, so update the viewer.
What's affected
The record lists Sante DICOM Viewer Pro as affected without a version range. The ZDI advisory says the issue is fixed in version 12.2.4, so earlier builds should be treated as vulnerable. The flaw is in the parsing of DCM files.
ZDI reported it to the vendor on 17 May 2023 and published the advisory on 8 June 2023. Credit in the advisory for the first of these cases goes to Mat Powell of the Trend Micro Zero Day Initiative.
How to check if you're exposed
Sante DICOM Viewer Pro is desktop software, so check the installed version. Open the application's About dialog, or on Windows go to Settings, then Apps, and read the version for the product. Anything older than 12.2.4 should be treated as exposed.
For a fleet, ask your endpoint or software inventory tool for every machine with the viewer installed, and record the version. Include workstations used by radiology, research and outside reading partners, and any shared images or virtual machines that carry the install.
Also note where files reach the viewer. DICOM images move by disc, download link, email and image sharing portals, which are all ways an untrusted file can arrive.
What to do now
- Update Sante DICOM Viewer Pro to version 12.2.4 or later, the fixed release named in the ZDI advisory.
- Until you have updated, do not open DCM files from unknown or unverified sources.
- Open outside images in a dedicated workstation or virtual machine that has no access to patient records or file shares.
- Tell staff that a medical image file can carry an attack, even when it looks routine.
- Add the viewer and its version to your asset list so the next advisory is a lookup.
Why it matters
An out-of-bounds write means the program stores data beyond the end of the memory it set aside. The advisory describes a write past the end of an allocated object, caused by missing validation of data in the file.
Code runs in the context of the current process, so the damage depends on the account of the person who opened the file. Clinical and research workstations often have broad access, which raises the stakes. Image viewers also tend to sit outside the usual patch routine because they are not seen as security tools.
The weakness classes involved are CWE-787 (Out-of-bounds Write). The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and none of the advisories I read says it is exploited in the wild. That can change, so treat the status as a snapshot.
Source conflict: NVD scores this CVE 8.8 with a network vector (AV:N). The ZDI advisory lists 7.8 with a local vector (AV:L/AC:L). Both are shown here. In both, a user must open a malicious file or visit a malicious page.
Quick check
Is the attack remote?
The attacker can be remote, but a user has to open a malicious file or visit a malicious page. Nothing happens until someone opens the file.
Which version fixes it?
The ZDI advisory says 12.2.4. Confirm with the vendor's own release notes.
Sources
Last reviewed: 19 October 2026.
