CVE-2025-2263 is a critical (CVSS 9.8) stack-based buffer overflow in the Sante PACS Server login. An unauthenticated remote attacker can overflow a fixed buffer with a long encrypted username or password. Tenable tested version 4.1.0 and reports Santesoft confirmed a fix in release 4.2.0.
What's affected
Tenable's research advisory TRA-2025-08 lists Sante PACS Server 4.1.0 as the affected product and groups four CVEs, among them CVE-2025-2263. The timeline in that advisory says Santesoft confirmed on 11 March 2025 that the issues were addressed in the latest release, 4.2.0.
Tenable tested 4.1.0, so it does not say which earlier builds are also affected. If you run any version below 4.2.0, treat it as exposed and check the Santesoft release notes. The vector is AV:N/AC:L/PR:N/UI:N: a network attack, low complexity, no privileges, no user action.
How to check if you're exposed
Check the version of the Sante PACS Server installation. The advisory refers to the file version of the executable, Sante PACS Server.exe, as 4.1.0.0 in the tested build, so the file properties on that executable are a quick check on Windows.
Then check where the server's web interface listens. A PACS server stores medical imaging, and many sites expose it to more networks than they need. List the firewall rules that allow access to its web port and who is on the other side.
Reading an inventory is faster than checking host by host. Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory you can search for any CVE. Reachability analysis helps you see whether a vulnerable component is actually used in your code, so you can fix the exposed ones first.
What to do now
- Upgrade Sante PACS Server to 4.2.0 or later after reading the Santesoft release notes.
- Take a backup of the configuration and data before the upgrade.
- Remove direct internet exposure of the PACS web interface. Put it behind a VPN or an allowlist.
- Check for related issues, since TRA-2025-08 lists three other CVEs for the same product.
- Record the version and the date of the change for your asset inventory.
Why it matters
CWE-121 is a stack-based buffer overflow and CWE-787 is an out-of-bounds write. The login code decrypts a supplied username or password into a fixed buffer of 0x80 bytes, which is 128 bytes, and does not check that the decrypted data fits. Longer input writes past the buffer on the stack.
Because this happens during login, before any authentication check, anyone who can reach the web port can send the request. That is why the score is 9.8. The cure is bounds checking on the output length of the decrypt call, and the vendor fixed it in a later release. The record does not flag the CVE as exploited, and the KEV flag is false.
Quick check
Which release fixes CVE-2025-2263?
Tenable reports Santesoft confirmed the issues were updated in release 4.2.0. Check the vendor notes for details.
Does an attacker need credentials?
No. The overflow happens in the login routine, and the vector shows no privileges required.
Sources
Last reviewed: 19 October 2026.
