GDCM (Product): news timeline & CVEs

[SYSS-2026-071]: GDCM (Grassroots DICOM) - Format String (CWE-134)

SySS disclosed an unpatched medium-risk format-string flaw in GDCM 3.3.0, with no CVE assigned.

SySS published advisory SYSS-2026-071 describing a format-string vulnerability (CWE-134) in GDCM (Grassroots DICOM) 3.3.0, the tested version. Risk is rated medium and the solution status is open, so no fix is listed. The vendor was notified on 2026-07-24 and the issue was disclosed on 2026-09-23. No CVE has been assigned and exploitation is not reported.

Full Disclosure04:16 UTC · 5h agoVulnerability 5 sources

[SYSS-2026-070]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

SySS disclosed unpatched high-risk integer overflow SYSS-2026-070 in GDCM 3.3.0, with no CVE.

SySS advisory SYSS-2026-070 reports an integer overflow (CWE-190) in GDCM (Grassroots DICOM) version 3.3.0. The lab rates the risk high and lists the solution status as open. The manufacturer was notified on 2026-07-24, with public disclosure on 2026-09-23. No CVE is assigned and the text does not claim exploitation in the wild.

Full Disclosure04:16 UTC · 5h agoVulnerability 5 sources

[SYSS-2026-069]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

SySS disclosed a second unpatched high-risk integer overflow, SYSS-2026-069, in GDCM 3.3.0.

SySS advisory SYSS-2026-069 describes a distinct integer overflow (CWE-190) in the GDCM Grassroots DICOM library, affecting tested version 3.3.0. Risk is rated high and the solution status is open. The GDCM Project was notified on 2026-07-24 and the flaw was publicly disclosed on 2026-09-23. No CVE has been assigned and active exploitation is not mentioned.

Full Disclosure04:16 UTC · 5h agoVulnerability 5 sources

[SYSS-2026-068]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

SySS disclosed an unpatched stack-based buffer overflow in GDCM 3.3.0, a Grassroots DICOM library.

Full Disclosure published SySS advisory SYSS-2026-068 describing a stack-based buffer overflow (CWE-121) in GDCM (Grassroots DICOM) version 3.3.0, which was tested. The GDCM Project was notified on 2026-07-24 and the issue was publicly disclosed on 2026-09-23. No CVE has been assigned and the solution status remains open, so no fix is available. The advisory rates the risk as high and does not report observed exploitation.

Full Disclosure04:16 UTC · 5h agoVulnerability 5 sources

[SYSS-2026-067]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

SySS disclosed an unpatched stack-based buffer overflow in GDCM 3.3.0, with no CVE assigned.

SySS published advisory SYSS-2026-067 for Grassroots DICOM (GDCM) 3.3.0. The issue is a stack-based buffer overflow (CWE-121) that the vendor rates high. The manufacturer was notified on 2026-07-24 and the flaw was disclosed on 2026-09-23. No fix is available and no CVE has been assigned.

Full Disclosure04:16 UTC · 5h agoVulnerability 5 sources

GDCM <= 3.2.7: six memory-safety and denial-of-service vulnerabilities, no CVE

Six memory-safety and denial-of-service flaws disclosed in the GDCM DICOM parsing library, affecting versions through 3.2.7.

Researcher Abhinav Agarwal disclosed six vulnerabilities in GDCM (Grassroots DICOM), an open-source C++ library for parsing and processing DICOM files. All six were confirmed against GDCM 3.2.6 using AddressSanitizer and UndefinedBehaviorSanitizer, and source review found the vulnerable patterns through version 3.2.7 and the upstream master snapshot. Potential impacts include heap corruption, process-memory disclosure, stack exhaustion, and process termination in applications parsing untrusted DICOM files. No CVE identifiers have been assigned at the time of disclosure.

oss-securitySep 10, 03:35 UTC · 17d agoVulnerability

GDCM

Timeline6 articles

Appears with

[SYSS-2026-071]: GDCM (Grassroots DICOM) - Format String (CWE-134)

[SYSS-2026-070]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

[SYSS-2026-069]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

[SYSS-2026-068]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

[SYSS-2026-067]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

GDCM <= 3.2.7: six memory-safety and denial-of-service vulnerabilities, no CVE