GDCM <= 3.2.7: six memory-safety and denial-of-service vulnerabilities, no CVE
Six memory-safety and denial-of-service flaws disclosed in the GDCM DICOM parsing library, affecting versions through 3.2.7.
Researcher Abhinav Agarwal disclosed six vulnerabilities in GDCM (Grassroots DICOM), an open-source C++ library for parsing and processing DICOM files. All six were confirmed against GDCM 3.2.6 using AddressSanitizer and UndefinedBehaviorSanitizer, and source review found the vulnerable patterns through version 3.2.7 and the upstream master snapshot. Potential impacts include heap corruption, process-memory disclosure, stack exhaustion, and process termination in applications parsing untrusted DICOM files. No CVE identifiers have been assigned at the time of disclosure.
38