GDCM <= 3.2.7: six memory-safety and denial-of-service vulnerabilities, no CVE

Published September 10, 2026 CVE-2024-22373

A malicious medical imaging file can corrupt memory when GDCM decodes it. The affected application may crash.

Severity
HighCVSS 3.1 · 8.1 · cisco.com
Fix
Not confirmedLast checked today
Affected versions
3.0.23
Weakness
CWE-119Improper Restriction of Memory Buffer Operations
Exploit likelihood
1.6% in 30 daysEPSS, higher than 74% of known flaws
Affects
Grassroot DICOM
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: total
EU ID
EUVD-2024-19930ENISA vulnerability database

How it works

  • An attacker supplies a specially built DICOM file containing JPEG 2000 image data.
  • GDCM uses dimensions from the file to reserve workspace.
  • The decoded image can require more space than those dimensions provide.
  • A missing size check lets GDCM write outside that workspace.
  • This corrupts application memory and can crash the process.

What to do

If you maintain an application using Grassroot DICOM, check its dependency or build records for version 3.0.23. Treat 3.0.23 as confirmed affected; the advisory does not establish a broader release range.

Update to a vendor release containing the fix identified by Talos. Review the Talos advisory, because it names no fixed release number. Ask your software supplier to confirm its GDCM build contains that fix.

Technical details

Affected software: Grassroot DICOMby Grassroot DICOM

CVE-2024-22373 affects JPEG2000Codec::DecodeByStreamsCommon in Grassroot DICOM 3.0.23. The allocation uses dimensions declared by the DICOM file, while the decoding loop uses dimensions returned from its JPEG 2000 data. Missing bounds checks allow the loop to write beyond the allocated memory. Talos confirmed version 3.0.23 and reported that the vendor fixed the code.

The retrieved advisory does not identify a fixed release number.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity High Attack depends on conditions outside the attacker's control
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source