CyberRota Analysis
AI-GeneratedDCMTK versions up to 3.7.0 are vulnerable to a heap over-read in the ConcatenationLoader, which fails to validate the PixelData buffer length against the declared NumberOfFrames. This flaw allows attackers to craft malicious DICOM instances that can either crash the application or leak sensitive adjacent heap memory. Organizations utilizing DCMTK for medical imaging should prioritize patching this vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.