CVE-2025-11266
📋 TL;DR
An out-of-bounds write vulnerability in Grassroots DICOM library (GDCM) allows attackers to cause denial-of-service by crashing applications that parse malicious DICOM files. This affects any system using GDCM to process medical imaging files. The vulnerability is triggered simply by opening a specially crafted DICOM file.
💻 Affected Systems
- Grassroots DICOM library (GDCM)
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete application crash leading to denial-of-service for medical imaging systems, potentially disrupting healthcare workflows and patient care.
Likely Case
Application crashes when processing malicious DICOM files, causing temporary service disruption until restart.
If Mitigated
Limited impact with proper input validation and file scanning in place.
🎯 Exploit Status
Exploitation requires only file upload/opening, no authentication needed. Simple to trigger but currently only causes DoS.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.2.2
Vendor Advisory: https://github.com/malaterre/GDCM/releases/tag/v3.2.2
Restart Required: Yes
Instructions:
1. Download GDCM v3.2.2 from GitHub releases. 2. Replace existing GDCM installation. 3. Rebuild any applications using GDCM. 4. Restart affected services.
🔧 Temporary Workarounds
Input validation for DICOM files
allImplement strict validation of DICOM files before processing, rejecting files with malformed PixelData fragments.
Sandbox DICOM processing
allIsolate DICOM file processing in containerized or sandboxed environments to limit impact of crashes.
🧯 If You Can't Patch
- Implement network segmentation to isolate medical imaging systems
- Deploy file integrity monitoring on DICOM processing systems
🔍 How to Verify
Check if Vulnerable:
Check GDCM version: gdcm --version or examine library files. Versions before 3.2.2 are vulnerable.Check Version:
gdcm --version 2>/dev/null || strings /usr/lib/libgdcm* | grep -i versionVerify Fix Applied:
Verify GDCM version is 3.2.2 or later and test with known safe DICOM files.📡 Detection & Monitoring
Log Indicators:
- Segmentation fault errors in application logs
- Unexpected process termination of DICOM processing applications
- Core dump files in application directories
Network Indicators:
- Unusual DICOM file transfers from untrusted sources
- Multiple failed DICOM parsing attempts
SIEM Query:
source="application.logs" AND ("segmentation fault" OR "SIGSEGV") AND process="*gdcm*" OR "*dicom*"