CVE-2024-42845 in InVesalius
Summary
by MITRE • 08/23/2024
An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to execute arbitrary code via loading a crafted DICOM file.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 02/13/2026
The vulnerability identified as CVE-2024-42845 represents a critical eval injection flaw within the InVesalius medical imaging software suite. This security weakness exists in the dicom.py component of InVesalius versions ranging from 3.1.99991 through 3.1.99998, creating a significant attack surface that could be exploited by malicious actors to execute arbitrary code on affected systems. The vulnerability specifically manifests when the software processes specially crafted DICOM files, which are standard medical imaging formats used extensively in healthcare environments for storing and transmitting patient data.
The technical nature of this flaw stems from the improper handling of user-supplied data within the dicom.py module, where the application employs eval() functions to process DICOM metadata or attributes. This pattern violates fundamental security principles and creates a direct path for code execution attacks. The eval() function in python interprets string input as executable code, making it extremely dangerous when fed with untrusted data. Attackers can craft malicious DICOM files containing specially formatted payloads that, when loaded by the vulnerable InVesalius version, trigger the eval() function to execute arbitrary commands on the target system. This vulnerability falls under CWE-94, which specifically addresses "Improper Control of Generation of Code ('Code Injection')" and aligns with ATT&CK technique T1059.001 for "Command and Scripting Interpreter: Python".
The operational impact of this vulnerability extends beyond simple code execution, as it fundamentally compromises the integrity and security of medical imaging environments. Healthcare organizations using affected InVesalius versions face severe risks including unauthorized access to patient data, potential system compromise, and disruption of critical medical workflows. The attack vector is particularly concerning because DICOM files are routinely exchanged between medical devices, hospitals, and imaging centers, making them an ideal delivery mechanism for exploitation. An attacker could potentially deploy malware, establish backdoors, or exfiltrate sensitive patient information through this vulnerability. The risk is amplified in healthcare settings where system availability and data integrity are paramount, as this vulnerability could lead to system downtime during critical medical procedures or compromise patient safety through data manipulation.
Mitigation strategies for CVE-2024-42845 must prioritize immediate software updates to versions that have addressed this vulnerability through proper input validation and elimination of eval() usage in the dicom.py component. Organizations should implement network segmentation to limit access to medical imaging systems and establish strict file validation policies for DICOM files entering the environment. Additionally, security monitoring should be enhanced to detect unusual file processing activities or unexpected code execution patterns within medical imaging workstations. The remediation process should include thorough vulnerability scanning of all InVesalius installations, followed by immediate patching of affected systems. System administrators should also consider implementing application whitelisting policies to prevent execution of unauthorized code, and establish incident response procedures specifically tailored for medical imaging security incidents. Organizations should conduct comprehensive security assessments of their medical imaging infrastructure to identify and remediate similar vulnerabilities that may exist in other components of their healthcare information systems.