CVE-2024-47796
📋 TL;DR
An improper array index validation vulnerability in OFFIS DCMTK's nowindow functionality allows out-of-bounds writes when processing specially crafted DICOM files. Attackers can exploit this to potentially execute arbitrary code or cause denial of service. Systems using DCMTK for medical imaging processing are affected.
💻 Affected Systems
- OFFIS DCMTK
📦 What is this software?
Dcmtk by Offis
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Application crash causing denial of service in medical imaging workflows, potentially disrupting patient care.
If Mitigated
Contained application crash with no privilege escalation if proper sandboxing and least privilege are implemented.
🎯 Exploit Status
Requires crafting a malicious DICOM file and getting it processed by vulnerable system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 89a6e399f1e17d08a8bc8cdaa05b2ac9a50cd4f6
Vendor Advisory: https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=89a6e399f1e17d08a8bc8cdaa05b2ac9a50cd4f6
Restart Required: No
Instructions:
1. Update DCMTK to latest version with fix. 2. Rebuild applications using DCMTK libraries. 3. Test with sample DICOM files to ensure functionality.
🔧 Temporary Workarounds
Disable nowindow functionality
allConfigure applications to avoid using the vulnerable nowindow component when processing DICOM files.
Input validation
allImplement strict validation of DICOM file headers before processing.
🧯 If You Can't Patch
- Isolate DCMTK processing to dedicated, sandboxed systems with no internet access.
- Implement strict file upload controls and scan all incoming DICOM files with multiple antivirus engines.
🔍 How to Verify
Check if Vulnerable:
Check DCMTK version: dcmdump --version. If version is 3.6.8 or earlier, system is vulnerable.Check Version:
dcmdump --version 2>&1 | grep -i versionVerify Fix Applied:
Verify DCMTK version includes commit 89a6e399f1e17d08a8bc8cdaa05b2ac9a50cd4f6 or later.📡 Detection & Monitoring
Log Indicators:
- Application crashes in DCMTK processes
- Memory access violation errors
- Abnormal DICOM file processing failures
Network Indicators:
- Unusual DICOM file transfers from untrusted sources
- Large volumes of DICOM files to single endpoint
SIEM Query:
source="dcmtk" AND (event_type="crash" OR error="segmentation fault" OR error="access violation")🔗 References
- https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=89a6e399f1e17d08a8bc8cdaa05b2ac9a50cd4f6
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-2122
- https://lists.debian.org/debian-lts-announce/2025/01/msg00032.html
- https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2122
