Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

SySS discloses five unpatched flaws in GDCM 3.3.0

1 source · 5 articlesFirst reported Updated ()2
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

SySS disclosed five unpatched GDCM 3.3.0 flaws—two stack overflows, two integer overflows, and one format-string bug—with no CVEs.

Full Disclosure carried five SySS advisories on Grassroots DICOM (GDCM) 3.3.0, the version SySS tested. SYSS-2026-067 and SYSS-2026-068 are stack-based buffer overflows (CWE-121) rated high; SYSS-2026-069 and SYSS-2026-070 are integer overflows (CWE-190) also rated high; SYSS-2026-071 is a format-string issue (CWE-134) rated medium. The GDCM Project was notified on 2026-07-24 and the flaws were publicly disclosed on 2026-09-23. No fixes are available, solution status remains open, and no CVE identifiers have been assigned. The advisories do not report exploitation. Sources agree on version, dates, and ratings, except that the SYSS-2026-067 note attributes the high rating to the vendor while the other advisories attribute ratings to SySS.

Key facts
  • Grassroots DICOM (GDCM) 3.3.0 is the affected and tested version in all five SySS advisories.
  • SYSS-2026-067 and SYSS-2026-068 are stack-based buffer overflows (CWE-121), rated high, with no CVE and no fix.
  • SYSS-2026-069 and SYSS-2026-070 are integer overflows (CWE-190), rated high, with solution status open and no CVE.
  • SYSS-2026-071 is a format-string flaw (CWE-134), rated medium, with no fix and no CVE.
  • The GDCM Project was notified on 2026-07-24; public disclosure was 2026-09-23; Full Disclosure items are dated 2026-09-27.
  • The advisories do not report observed or in-the-wild exploitation.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
GDCM Project
Products
GDCM
Organizations
SySSGDCM Project

Coverage

oldest first · one row per article · UTC
  1. · Sep 27, 2026 Full DisclosureFirst report

    [SYSS-2026-067]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

    SySS disclosed an unpatched stack-based buffer overflow in GDCM 3.3.0, with no CVE assigned.

  2. · Sep 27, 2026 Full Disclosure

    [SYSS-2026-068]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)

    SySS disclosed an unpatched stack-based buffer overflow in GDCM 3.3.0, a Grassroots DICOM library.

  3. · Sep 27, 2026 Full Disclosure

    [SYSS-2026-069]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

    SySS disclosed a second unpatched high-risk integer overflow, SYSS-2026-069, in GDCM 3.3.0.

  4. · Sep 27, 2026 Full Disclosure

    [SYSS-2026-070]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)

    SySS disclosed unpatched high-risk integer overflow SYSS-2026-070 in GDCM 3.3.0, with no CVE.

  5. · Sep 27, 2026 Full Disclosure

    [SYSS-2026-071]: GDCM (Grassroots DICOM) - Format String (CWE-134)

    SySS disclosed an unpatched medium-risk format-string flaw in GDCM 3.3.0, with no CVE assigned.