CVE-2024-1453 is a high severity (CVSS 7.8) out-of-bounds read in Sante DICOM Viewer Pro 14.0.3 and earlier. A user who opens a malicious DICOM file could expose information or allow code execution. CISA's medical advisory says the vendor recommends updating to v14.0.4 or later.
What's affected
The CISA advisory ICSMA-24-058-01 lists Sante DICOM Viewer Pro versions 14.0.3 and prior as affected. The vendor recommends updating to v14.0.4 or later. The advisory was first published on 27 February 2024.
CISA's score is 7.8 with the vector AV:L/AC:L/PR:N/UI:R, matching the NVD record, so there is no severity conflict. The attack is local and needs a person to open a file, so the exposure comes from how DICOM files reach the workstation.
How to check if you're exposed
Open Help and About in the application to read the version. Anything at or below 14.0.3 needs an update.
Then trace how files arrive. DICOM files can come from a PACS, email, removable media or a download. Workstations that open files from sources you do not control carry the most risk. CISA also lists general measures against social engineering attacks in its advisory.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Inventory every workstation that runs Sante DICOM Viewer Pro.
- Update each one to v14.0.4 or later.
- Tell staff not to open DICOM files from unknown senders or media.
- Limit the viewer's permissions on the workstation to what clinicians need.
- Follow the defensive measures in the CISA advisory for your environment.
Why it matters
The weakness is CWE-125, an out-of-bounds read. The parser read past the end of a buffer while handling a crafted file. Depending on what lies beyond the buffer, the result is information disclosure, and with more work it can lead to code execution, which is what the advisory states.
File viewers are a steady source of this kind of bug, because they parse complex formats from many sources. In a clinical setting the data is sensitive and the workstation may be on a network with other medical systems. The record's KEV flag is false.
Quick check
Can this be exploited remotely without user action?
No. The vector shows a local attack that needs user interaction, in this case opening a file.
What is the fixed version?
CISA says to update to v14.0.4 or later.
Sources
Last reviewed: 19 October 2026.
