Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

[SYSS-2026-071]: GDCM (Grassroots DICOM) - Format String (CWE-134)

Full Disclosure ()1 · 1 read
Read at seclists.org
Part of a story covered by 5 sourcesSySS discloses five unpatched flaws in GDCM 3.3.0Merged summary & timeline
AI summary · grok-4.7Summaries by Vani AI

SySS disclosed an unpatched medium-risk format-string flaw in GDCM 3.3.0, with no CVE assigned.

SySS published advisory SYSS-2026-071 describing a format-string vulnerability (CWE-134) in GDCM (Grassroots DICOM) 3.3.0, the tested version. Risk is rated medium and the solution status is open, so no fix is listed. The vendor was notified on 2026-07-24 and the issue was disclosed on 2026-09-23. No CVE has been assigned and exploitation is not reported.

Key facts
  • Format-string flaw (CWE-134) in GDCM 3.3.0.
  • SySS rates risk as medium.
  • No fix; solution status remains open.
  • No CVE has been assigned yet.
  • Vendor was notified on 2026-07-24.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
gdcmdicomformat-stringcwe-134unpatchedsyss
Vendors
GDCM Project
Products
GDCM
Organizations
SySSGDCM Project

From the original article

Posted by Matthias Deeg via Fulldisclosure on Sep 26 Advisory ID: SYSS-2026-071 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3. 3. 0 Tested Version(s): 3.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.