Grassroots DICOM Library prior 3.2.2 DICOM File Parser out-of-bounds write

Summaryinfo

A vulnerability classified as critical has been found in Grassroots DICOM Library. The impacted element is an unknown function of the component DICOM File Parser. Performing a manipulation results in out-of-bounds write. This vulnerability is identified as CVE-2025-11266. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Grassroots DICOM Library. This affects some unknown processing of the component DICOM File Parser. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. CWE is classifying the issue as CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An out-of-bounds write vulnerability exists in the Grassroots DICOM library (GDCM). The issue is triggered during parsing of a malformed DICOM file containing encapsulated PixelData fragments (compressed image data stored as multiple fragments). This vulnerability leads to a segmentation fault caused by an out-of-bounds memory access due to unsigned integer underflow in buffer indexing. It is exploitable via file input, simply opening a crafted malicious DICOM file is sufficient to trigger the crash, resulting in a denial-of-service condition.

The weakness was released by Morgen Malinoski. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2025-11266 since 10/03/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 278621 (Linux Distros Unpatched Vulnerability : CVE-2025-11266), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.2.2 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the databases at Tenable (278621) and EUVD (EUVD-2025-203169). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Software Library

Vendor

• Grassroots

Name

• DICOM Library

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion