Patch Released for Medium-severity Grassroots DICOM Vulnerability
A medium-severity vulnerability has been identified in the Grassroots DICOM open source library for DICOM medical image files. The vulnerability can be exploited in a low complexity attack and could allow an attacker to craft a malicious DICOM file. Should that file be opened, it could crash the application and trigger a denial-of-service condition.
The out-of-bounds write vulnerability is present in the Grassroots DICOM library (GDCM) and is triggered during the parsing of a malformed DICOM file containing encapsulated PixelData fragments. The vulnerability results in out-of-bounds memory access, causing a segmentation fault. The vulnerability is due to an unsigned integer underflow in buffer indexing, and can be exploited via file input, only requiring a specially crafted malicious DICOM file to be opened to trigger a crash.
The vulnerability is tracked as CVE-2025-11266 and has been assigned a CVSS v3.1 base score of 6.6 and a CVSS v4 score of 6.8. The vulnerability was identified by cybersecurity analyst Morgen Malinoski, who reported the vulnerability to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
The vulnerability has been fixed, and users should ensure that they update to version 3.2.2 or later versions of Grassroots DICOM, which can be downloaded from the main GitHub repository. CISA reports that SimpleITK and medInria have released fixes for the vulnerability.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
As a precaution against vulnerability exploitation, CISA recommends locating control system devices and/or systems behind firewalls and isolating them from business networks, and also ensuring that they cannot be accessed from the Internet. If remote access cannot be disabled, secure methods should be used to connect, such as a virtual private network (VPN), ensuring the VPN is running the latest software version.
