What is the CVSS score of CVE-2026-2034?

CVE-2026-2034 has a CVSS 3.0 base score of 7.8 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Dicom Viewer Pro are affected by CVE-2026-2034?

A critical remote code execution vulnerability exists in Sante DICOM Viewer Pro that could allow attackers to compromise any system running this medical imaging software.

How to fix or mitigate CVE-2026-2034?

Within 24 hours: Inventory all installations of Sante DICOM Viewer Pro and restrict network access to affected systems. Within 7 days: Disable remote file processing capabilities or isolate vulnerable systems from production networks pending vendor patch release. Within 30 days: Contact vendor for patch availability timeline; if no patch emerges, conduct risk assessment to determine if alternative DICOM viewing solutions should replace this software.

Dicom Viewer Pro CVE-2026-2034

HIGH

Classic Buffer Overflow (CWE-120)

2026-02-20 zdi-disclosures@trendmicro.com

RCE Buffer Overflow Dicom Viewer Pro

7.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:04 vuln.today

CVE Published

Feb 20, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28129.

AnalysisAI

Remote code execution in Sante DICOM Viewer Pro via buffer overflow when parsing malicious DCM files allows attackers to execute arbitrary code on affected systems. The vulnerability stems from insufficient validation of user-supplied data length before copying to a buffer, requiring user interaction such as opening a malicious file or visiting a compromised page. No patch is currently available for this high-severity flaw.

Technical ContextAI

Classified as CWE-120 (Classic Buffer Overflow). Affects Dicom Viewer Pro. Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of the length of user-supplied data prior