CVE-2024-1696 is a high severity (CVSS 7.8) out of bounds write in Santesoft Sante FFT Imaging versions 1.4.1 and prior. When a user opens a malicious DCM file, a local attacker could execute arbitrary code. Santesoft recommends updating to version 1.4.2 or later.
What's affected
CISA's ICS medical advisory ICSMA-24-065-01, released on 5 March 2024, lists Sante FFT Imaging versions 1.4.1 and prior as affected. The vendor is Santesoft, headquartered in Cyprus, and the product is used in the healthcare and public health sector. CISA says Michael Heinzl reported the issue.
The advisory's CVSS v3.1 score is 7.8 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, which matches the NVD record. The weakness is CWE-787 (out of bounds write). Santesoft released an updated version and recommends 1.4.2 or later.
How to check if you're exposed
Open the application and check its version in the about dialog. Anything at or below 1.4.1 is affected. In a clinical or lab setting, find every workstation that has the viewer installed, including shared machines and imaging stations that nobody has touched in a while.
Also check where DCM files come from. Files received from outside the organization, by email or removable media, are the ones to treat with care.
What to do now
- Upgrade Sante FFT Imaging to 1.4.2 or later on all workstations.
- Until upgraded, avoid opening DCM files from untrusted sources.
- Follow CISA's general recommendations for industrial control and medical systems, such as minimizing network exposure.
- Keep imaging workstations off general internet browsing and email where you can.
- Record the installed versions so future advisories are easy to check.
Why it matters
The issue is a memory write beyond a buffer when the program parses a file. File parsers are a common home for this class because the file format has many fields and lengths that the program must validate. When it does not, a crafted file can overwrite memory and take control.
The user has to open the file, so the CVSS says user interaction is required. The record's KEV flag is false and the advisory does not report exploitation. For healthcare environments, the larger concern is how long imaging software stays unpatched. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
What is the fixed version?
Santesoft recommends version 1.4.2 or later, per the CISA advisory.
Sources
Last reviewed: 19 October 2026.
