CVE-2025-25475
📋 TL;DR
A NULL pointer dereference vulnerability in DCMTK's DICOM file processing component allows attackers to cause denial of service by sending specially crafted DICOM files. This affects systems running vulnerable versions of DCMTK that process untrusted DICOM files, particularly in healthcare and medical imaging environments.
💻 Affected Systems
- DCMTK (DICOM Toolkit)
📦 What is this software?
Dcmtk by Offis
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of DICOM processing applications, potentially affecting medical imaging workflows and patient care systems.
Likely Case
Application crash or hang when processing malicious DICOM files, requiring manual restart of affected services.
If Mitigated
Isolated service interruption with minimal impact due to proper segmentation and redundancy controls.
🎯 Exploit Status
Exploitation requires crafting a malicious DICOM file and delivering it to a vulnerable system. No authentication bypass is needed if the system accepts DICOM files from untrusted sources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit bffa3e9116abb7038b432443f16b1bd390e80245
Vendor Advisory: https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html
Restart Required: No
Instructions:
1. Update DCMTK to a patched version. 2. Rebuild applications using DCMTK libraries. 3. Test DICOM processing functionality after update.
🔧 Temporary Workarounds
Input Validation
allImplement strict input validation for DICOM files before processing
Process Isolation
allRun DICOM processing in isolated containers or sandboxes to limit crash impact
🧯 If You Can't Patch
- Implement network segmentation to restrict DICOM file sources to trusted systems only
- Deploy application monitoring with automatic restart capabilities for crash detection
🔍 How to Verify
Check if Vulnerable:
Check DCMTK version and verify if it includes the vulnerable commit. Review if /libsrc/dcrleccd.cc component is used.Check Version:
dcmdump --version 2>&1 | grep -i versionVerify Fix Applied:
Verify DCMTK version is updated beyond the vulnerable commit. Test with known safe DICOM files to ensure functionality.📡 Detection & Monitoring
Log Indicators:
- Application crashes or segmentation faults in DICOM processing logs
- Unexpected termination of DCMTK-related processes
Network Indicators:
- Unusual DICOM file transfers from untrusted sources
- Multiple failed DICOM processing attempts
SIEM Query:
source="application_logs" AND (process="dc*" OR process="*dcm*") AND (event="segmentation fault" OR event="crash" OR event="SIGSEGV")