CVE-2025-2357
📋 TL;DR
A critical memory corruption vulnerability in DCMTK's JPEG-LS decoder allows remote attackers to potentially execute arbitrary code or crash applications. This affects systems using DCMTK 3.6.9 for medical imaging processing. The vulnerability is remotely exploitable without authentication.
💻 Affected Systems
- DCMTK (DICOM Toolkit)
📦 What is this software?
Dcmtk by Offis
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment on affected medical imaging systems.
Likely Case
Application crashes causing denial of service in medical imaging workflows, potentially disrupting patient care and diagnostic processes.
If Mitigated
Limited impact with proper network segmentation and exploit prevention controls, though service disruption remains possible.
🎯 Exploit Status
Exploit has been publicly disclosed and memory corruption vulnerabilities in image decoders are commonly weaponized.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patch 3239a7915
Vendor Advisory: https://support.dcmtk.org/redmine/issues/1155
Restart Required: Yes
Instructions:
1. Download the patch from DCMTK issue tracker. 2. Apply patch 3239a7915 to DCMTK source code. 3. Recompile DCMTK. 4. Replace vulnerable binaries with patched versions. 5. Restart affected services.
🔧 Temporary Workarounds
Disable JPEG-LS Processing
allConfigure DCMTK to reject or skip JPEG-LS encoded images
Modify DCMTK configuration to disable dcmjpls decoder support
Network Segmentation
allIsolate DCMTK systems from untrusted networks
Implement firewall rules to restrict access to DCMTK services
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all DICOM image processing
- Deploy memory protection controls like ASLR and DEP, and monitor for crash events
🔍 How to Verify
Check if Vulnerable:
Check if DCMTK version is 3.6.9 and if dcmjpls component is present and activeCheck Version:
dcmdump --version | grep -i dcmtkVerify Fix Applied:
Verify patch 3239a7915 is applied by checking source code or running tests with known malicious JPEG-LS samples📡 Detection & Monitoring
Log Indicators:
- DCMTK process crashes
- Memory access violation errors
- Unexpected termination of medical imaging services
Network Indicators:
- Unusual network traffic to DCMTK ports (default 104)
- Multiple connection attempts with malformed DICOM data
SIEM Query:
process_name:"dcmtk" AND (event_type:crash OR error_message:"memory" OR error_message:"corruption")