[SYSS-2026-068]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)
SySS disclosed an unpatched stack-based buffer overflow in GDCM 3.3.0, a Grassroots DICOM library.
Full Disclosure published SySS advisory SYSS-2026-068 describing a stack-based buffer overflow (CWE-121) in GDCM (Grassroots DICOM) version 3.3.0, which was tested. The GDCM Project was notified on 2026-07-24 and the issue was publicly disclosed on 2026-09-23. No CVE has been assigned and the solution status remains open, so no fix is available. The advisory rates the risk as high and does not report observed exploitation.
- Stack-based buffer overflow (CWE-121) in GDCM 3.3.0
- Advisory SYSS-2026-068; no CVE assigned yet
- Vendor notified 2026-07-24; disclosed 2026-09-23
- Solution status remains open; risk rated high
- Vendors
- GDCM Project
- Products
- GDCM
- Organizations
- SySS
From the original article
Posted by Matthias Deeg via Fulldisclosure on Sep 26 Advisory ID: SYSS-2026-068 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3. 3. 0 Tested Version(s): 3.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.