CVE-2025-9732
📋 TL;DR
A memory corruption vulnerability in DCMTK's dcm2img component allows local attackers to potentially crash applications or execute arbitrary code. This affects DCMTK versions up to 3.6.9. The vulnerability requires local access to the system to exploit.
💻 Affected Systems
- DCMTK (DICOM Toolkit)
📦 What is this software?
Dcmtk by Offis
⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation leading to full system compromise or arbitrary code execution with the privileges of the DCMTK process.
Likely Case
Application crash (denial of service) or limited memory corruption leading to unstable behavior.
If Mitigated
Minimal impact if proper access controls prevent unauthorized local users from interacting with DCMTK processes.
🎯 Exploit Status
Exploitation requires local access and knowledge of the vulnerable function. No public exploit code has been identified at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in commit 7ad81d69b, version after 3.6.9
Vendor Advisory: https://github.com/DCMTK/dcmtk/commit/7ad81d69b
Restart Required: Yes
Instructions:
1. Update DCMTK to a version after 3.6.9 that includes commit 7ad81d69b. 2. Recompile any applications using DCMTK. 3. Restart affected services or applications.
🔧 Temporary Workarounds
Restrict local access
allLimit local user access to systems running DCMTK applications
Disable vulnerable component
allIf possible, disable or remove the dcm2img functionality
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local users from accessing DCMTK applications
- Monitor systems for abnormal process behavior or crashes related to DCMTK processes
🔍 How to Verify
Check if Vulnerable:
Check DCMTK version: dcmdump --version or examine installed package versionCheck Version:
dcmdump --version 2>/dev/null | head -1Verify Fix Applied:
Verify DCMTK version is greater than 3.6.9 or includes commit 7ad81d69b in git history📡 Detection & Monitoring
Log Indicators:
- Application crashes of DCMTK-related processes
- Memory access violation errors in application logs
Network Indicators:
- No network indicators - local vulnerability only
SIEM Query:
Process: (dcm* OR *dicom*) AND Event: (Crash OR AccessViolation OR SegmentationFault)