CVE-2019-5093CWE-190

An exploitable code execution vulnerability exists in the DICOM network response functionality of LEADTOOLS libltdic.so version 20.0.2019.3.15

High · published December 11, 2019

CVSS v3.0
8.1
EPSS
3%
Percentile
84.8
In the wild
Unconfirmed
What it is

⚡ A single crafted packet is all it takes to unleash chaos! An integer overflow vulnerability in LEADTOOLS can lead to heap corruption, making it a developer's worst nightmare. 🔥 Think of it like a faulty assembly line where a wrong-sized package causes the entire system to jam — one miscalculated integer can send the whole process spiraling out of control! If exploited, an attacker could potentially execute arbitrary code on the affected system, leading to unauthorized access, data leaks, or even complete control of the machine! This could be absolutely devastating for organizations relying on this library to process DICOM images.

Put simply

Think of it like a faulty assembly line where a wrong-sized package causes the entire system to jam — one miscalculated integer can send the whole process spiraling out of control! This vulnerability arises from integer overflow in the DICOM network response handling of the LEADTOOLS libltdic.so version 20.0.2019.3.15, allowing attackers to send specially crafted packets that corrupt the heap memory, potentially enabling code execution.

What to do

If exploited, an attacker could potentially execute arbitrary code on the affected system, leading to unauthorized access, data leaks, or even complete control of the machine! This could be absolutely devastating for organizations relying on this library to process DICOM images. Urgently patch your systems to the latest version of LEADTOOLS to eliminate this risk. Ensure you are running a version above 20.0.2019.3.16. Additionally, review your network configuration to limit exposure to untrusted packets. You've got this! With a quick patch and some vigilance, you'll secure your system and keep those code execution nightmares at bay! 🛡️

The record
Technical detail
CVSS v3.0
8.1 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02529 · 84.8th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2019-12-11T23:40Z
EPSS history
Timeline
  • 11 DEC 23:40Z
    An exploitable code execution vulnerability exists in the DICOM network response functionality of LEADTOOLS libltdic.so version 20.0.2019.3.15
    cvelistv5