Grassroots DICOM Library Out-of-Bounds Write Vulnerability Leading to Denial-of-Service

A vulnerability allowing out-of-bounds write operations has been identified in the Grassroots DICOM library (GDCM), specifically in versions through 3.0.24. This issue arises when the library parses malformed DICOM files that contain encapsulated PixelData fragments. The vulnerability is caused by an unsigned integer underflow in buffer indexing, leading to out-of-bounds memory access and a segmentation fault. Exploitation of this vulnerability is achieved simply by opening a crafted DICOM file, which triggers a crash and creates a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a segmentation fault, leading to a crash of the application and a denial-of-service condition.

Remediation

Users are advised to update Grassroots DICOM (GDCM) to version 3.2.2 or later. SimpleITK and medInria have also released fixes for this vulnerability.