High · published December 17, 2025
⚡ An out-of-bounds read vulnerability lurking in Grassroot DICOM 3.024 could let attackers peek into sensitive information with just one crafted DICOM file! Think of it like a librarian mistakenly allowing someone to read a secret document just because they slipped them a fake book — a sneaky way to access confidential info! An attacker can exploit this vulnerability to trigger an information leak, potentially revealing sensitive pixel data from medical images. This could pose a significant confidentiality risk, especially in a healthcare environment where patient data must be protected at all costs!
Think of it like a librarian mistakenly allowing someone to read a secret document just because they slipped them a fake book — a sneaky way to access confidential info! The flaw resides in the JPEGBITSCodec::InternalCode functionality, where the function `null_convert` is executed based on values from a malicious DICOM file, leading to unauthorized data exposure.
An attacker can exploit this vulnerability to trigger an information leak, potentially revealing sensitive pixel data from medical images. This could pose a significant confidentiality risk, especially in a healthcare environment where patient data must be protected at all costs! To remediate this vulnerability, patch your Grassroot DICOM to the latest version immediately. Additionally, consider implementing strict validation on DICOM file uploads to ensure only trusted files are processed. Regularly review and audit your software to maintain security standards. You've got this! With these steps, you'll enhance your defenses and keep your data safe! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| malaterre/grassroots_dicom | all versions | — |