Pixmeo OsiriX MD Use-After-Free Vulnerability Leading to Denial-of-Service

A use-after-free vulnerability has been identified in Pixmeo OsiriX MD, specifically in versions 14.0.1 (Build 2024-02-28) and prior. This vulnerability allows an attacker to upload a crafted DICOM file, causing memory corruption that leads to a denial-of-service condition. Additionally, the OsiriX MD Web Portal transmits credential information unencrypted, potentially allowing credential theft.

Impact

Exploitation of this vulnerability causes memory corruption, resulting in a denial-of-service condition.

Remediation

Users are advised to download the latest version of OsiriX MD. For additional support, contact Pixmeo directly.