CVE-2025-48429
📋 TL;DR
An out-of-bounds read vulnerability in Grassroot DICOM's RLECodec::DecodeByStreams function allows attackers to leak heap memory data by providing a specially crafted DICOM file. This affects systems running Grassroot DICOM 3.024 that process untrusted DICOM files, potentially exposing sensitive information.
💻 Affected Systems
- Grassroot DICOM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Sensitive application data, credentials, or system information could be exfiltrated from memory, potentially enabling further attacks or data breaches.
Likely Case
Information disclosure of heap memory contents, which may include partial application data, configuration details, or other sensitive information from the process memory space.
If Mitigated
Limited information leakage with no direct code execution, though leaked data could aid in developing further attacks.
🎯 Exploit Status
Exploitation requires crafting a malicious DICOM file and getting it processed by the vulnerable system. No authentication is needed if file upload/processing is accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Monitor Grassroot DICOM vendor for security updates
2. Apply patches when available
3. Test in non-production environment first
🔧 Temporary Workarounds
Restrict DICOM file processing
allLimit processing of untrusted DICOM files to reduce attack surface
Implement file validation
allAdd validation checks for DICOM files before processing
🧯 If You Can't Patch
- Implement strict input validation for DICOM files
- Isolate DICOM processing systems from sensitive networks
🔍 How to Verify
Check if Vulnerable:
Check if Grassroot DICOM version is 3.024 and processes DICOM filesCheck Version:
Check application version through Grassroot DICOM interface or configuration filesVerify Fix Applied:
Verify updated to patched version when available📡 Detection & Monitoring
Log Indicators:
- Unusual DICOM file processing errors
- Memory access violation logs
- Large or malformed DICOM file processing
Network Indicators:
- Unexpected DICOM file transfers to vulnerable systems
- Network traffic patterns indicating information exfiltration
SIEM Query:
source="grassroot_dicom" AND (event_type="error" OR event_type="exception") AND message="*memory*" OR message="*out of bounds*"