CVE-2025-53618
📋 TL;DR
An out-of-bounds read vulnerability in Grassroot DICOM's JPEGBITSCodec::InternalCode function allows attackers to leak sensitive information by providing specially crafted DICOM files. This affects systems using Grassroot DICOM 3.024 for medical imaging processing. The vulnerability can be exploited without authentication to read memory contents.
💻 Affected Systems
- Grassroot DICOM
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Memory disclosure leading to exposure of sensitive patient data, authentication credentials, or system information that could enable further attacks.
Likely Case
Information leakage from the application's memory space, potentially exposing DICOM metadata or adjacent memory contents.
If Mitigated
Limited impact with proper input validation and memory protection mechanisms in place.
🎯 Exploit Status
Exploitation requires crafting a malicious DICOM file and triggering the vulnerable grayscale_convert function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2210
Restart Required: No
Instructions:
1. Monitor Grassroot DICOM vendor for security updates. 2. Apply patches when available. 3. Test in non-production environment first.
🔧 Temporary Workarounds
Input Validation
allImplement strict validation of DICOM files before processing
Memory Protection
allEnable ASLR and other memory protection mechanisms
🧯 If You Can't Patch
- Restrict DICOM file processing to trusted sources only
- Implement network segmentation to isolate DICOM processing systems
🔍 How to Verify
Check if Vulnerable:
Check if Grassroot DICOM version 3.024 is installed and processing DICOM filesCheck Version:
Check application documentation for version identification methodVerify Fix Applied:
Verify updated version is installed and test with known safe DICOM files📡 Detection & Monitoring
Log Indicators:
- Application crashes
- Memory access violations
- Unusual DICOM file processing errors
Network Indicators:
- Unexpected DICOM file uploads
- Abnormal data exfiltration patterns
SIEM Query:
source="dicom_server" AND (event="crash" OR event="memory_error")