[SYSS-2026-067]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)
SySS disclosed an unpatched stack-based buffer overflow in GDCM 3.3.0, with no CVE assigned.
SySS published advisory SYSS-2026-067 for Grassroots DICOM (GDCM) 3.3.0. The issue is a stack-based buffer overflow (CWE-121) that the vendor rates high. The manufacturer was notified on 2026-07-24 and the flaw was disclosed on 2026-09-23. No fix is available and no CVE has been assigned.
- GDCM 3.3.0 is affected; SySS tested that version.
- Stack-based buffer overflow (CWE-121), vendor risk rated high.
- Notified 2026-07-24; disclosed 2026-09-23; no fix and no CVE.
Posted by Matthias Deeg via Fulldisclosure on Sep 26 Advisory ID: SYSS-2026-067 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Stack-based Buffer Overflow (CWE-121) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: Not yet assigned...
This source does not provide full text. Read it at seclists.org.