Grassroot DICOM 3.024 DICOM File Parser null_convert memory corruption

Summaryinfo

A vulnerability labeled as critical has been found in Grassroot DICOM 3.024. The impacted element is the function null_convert of the component DICOM File Parser. The manipulation results in memory corruption. This vulnerability was named CVE-2025-53619. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability was found in Grassroot DICOM 3.024. It has been classified as critical. Affected is the function null_convert of the component DICOM File Parser. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `null_convert` is called based of the value of the malicious DICOM file specifying the intended interpretation of the image pixel data

The advisory is shared for download at talosintelligence.com. This vulnerability is traded as CVE-2025-53619 since 07/07/2025. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 01/02/2026).

The vulnerability scanner Nessus provides a plugin with the ID 278977 (Linux Distros Unpatched Vulnerability : CVE-2025-53619), which helps to determine the existence of the flaw in a target environment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Tenable (278977). Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Grassroot

Name

• DICOM

Version

• 3.024

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion