High · published December 17, 2025
⚡ A crafty little out-of-bounds read vulnerability could leak sensitive data in Grassroot DICOM 3.024 with just a single malicious DICOM file! Think of it like a sneaky postman delivering your mail to the wrong address and exposing all your personal details — that's what can happen when this vulnerability is exploited! An attacker can exploit this flaw to access sensitive information that should remain private. This could lead to serious data breaches, including patient data leaks in a medical context — absolutely devastating!
Think of it like a sneaky postman delivering your mail to the wrong address and exposing all your personal details — that's what can happen when this vulnerability is exploited! The vulnerability arises in the Overlay::GrabOverlayFromPixelData function, where a specially crafted DICOM file allows an out-of-bounds read, leading to unauthorized information leakage.
An attacker can exploit this flaw to access sensitive information that should remain private. This could lead to serious data breaches, including patient data leaks in a medical context — absolutely devastating! To protect against this threat, developers should update Grassroot DICOM to the latest version where the vulnerability is patched. Additionally, validate all DICOM files before processing to prevent malicious files from being accepted. You've got this! By following these steps, you can secure your application and keep sensitive information safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| malaterre/grassroots_dicom | all versions | — |