GDCM Project (Vendor): news timeline & CVEs

[SYSS-2026-071]: GDCM (Grassroots DICOM) - Format String (CWE-134)

SySS disclosed an unpatched medium-risk format-string flaw in GDCM 3.3.0, with no CVE assigned.

SySS published advisory SYSS-2026-071 describing a format-string vulnerability (CWE-134) in GDCM (Grassroots DICOM) 3.3.0, the tested version. Risk is rated medium and the solution status is open, so no fix is listed. The vendor was notified on 2026-07-24 and the issue was disclosed on 2026-09-23. No CVE has been assigned and exploitation is not reported.

Full Disclosure04:16 UTC · 5h agoVulnerability 5 sources

[SYSS-2026-070]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

SySS disclosed unpatched high-risk integer overflow SYSS-2026-070 in GDCM 3.3.0, with no CVE.

SySS advisory SYSS-2026-070 reports an integer overflow (CWE-190) in GDCM (Grassroots DICOM) version 3.3.0. The lab rates the risk high and lists the solution status as open. The manufacturer was notified on 2026-07-24, with public disclosure on 2026-09-23. No CVE is assigned and the text does not claim exploitation in the wild.

Full Disclosure04:16 UTC · 5h agoVulnerability 5 sources

[SYSS-2026-069]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

SySS disclosed a second unpatched high-risk integer overflow, SYSS-2026-069, in GDCM 3.3.0.

SySS advisory SYSS-2026-069 describes a distinct integer overflow (CWE-190) in the GDCM Grassroots DICOM library, affecting tested version 3.3.0. Risk is rated high and the solution status is open. The GDCM Project was notified on 2026-07-24 and the flaw was publicly disclosed on 2026-09-23. No CVE has been assigned and active exploitation is not mentioned.

Full Disclosure04:16 UTC · 5h agoVulnerability 5 sources

[SYSS-2026-068]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

SySS disclosed an unpatched stack-based buffer overflow in GDCM 3.3.0, a Grassroots DICOM library.

Full Disclosure published SySS advisory SYSS-2026-068 describing a stack-based buffer overflow (CWE-121) in GDCM (Grassroots DICOM) version 3.3.0, which was tested. The GDCM Project was notified on 2026-07-24 and the issue was publicly disclosed on 2026-09-23. No CVE has been assigned and the solution status remains open, so no fix is available. The advisory rates the risk as high and does not report observed exploitation.

Full Disclosure04:16 UTC · 5h agoVulnerability 5 sources

[SYSS-2026-067]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

SySS disclosed an unpatched stack-based buffer overflow in GDCM 3.3.0, with no CVE assigned.

SySS published advisory SYSS-2026-067 for Grassroots DICOM (GDCM) 3.3.0. The issue is a stack-based buffer overflow (CWE-121) that the vendor rates high. The manufacturer was notified on 2026-07-24 and the flaw was disclosed on 2026-09-23. No fix is available and no CVE has been assigned.

Full Disclosure04:16 UTC · 5h agoVulnerability 5 sources

GDCM Project

Timeline5 articles

Appears with

[SYSS-2026-071]: GDCM (Grassroots DICOM) - Format String (CWE-134)

[SYSS-2026-070]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

[SYSS-2026-069]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

[SYSS-2026-068]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

[SYSS-2026-067]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)