Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

[SYSS-2026-067]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

Full Disclosure ()1
Read at seclists.org
Part of a story covered by 5 sourcesSySS discloses five unpatched flaws in GDCM 3.3.0Merged summary & timeline
AI summary · grok-4.7Summaries by Vani AI

SySS disclosed an unpatched stack-based buffer overflow in GDCM 3.3.0, with no CVE assigned.

SySS published advisory SYSS-2026-067 for Grassroots DICOM (GDCM) 3.3.0. The issue is a stack-based buffer overflow (CWE-121) that the vendor rates high. The manufacturer was notified on 2026-07-24 and the flaw was disclosed on 2026-09-23. No fix is available and no CVE has been assigned.

Key facts
  • GDCM 3.3.0 is affected; SySS tested that version.
  • Stack-based buffer overflow (CWE-121), vendor risk rated high.
  • Notified 2026-07-24; disclosed 2026-09-23; no fix and no CVE.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
gdcmdicombuffer-overflowcwe-121syssmedical-imaging
Vendors
GDCM Project
Products
GDCM
Organizations
SySS

From the original article

Posted by Matthias Deeg via Fulldisclosure on Sep 26 Advisory ID: SYSS-2026-067 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3. 3. 0 Tested Version(s): 3.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.