Technical impact
A memory leak has been identified in the Grassroots DICOM (GDCM) library. The flaw arises when the library parses malformed DICOM files containing non‑standard Value Representation (VR) types in the file meta information section. As a result, large amounts of memory are allocated and never released, causing the heap to be exhausted in a single read operation and ultimately leading to a denial‑of‑service condition. This bug directly maps to the CWE identifiers for memory leak (CWE‑401) and resource exhaustion (CWE‑770).
Affected Systems
Grassroots DICOM (GDCM), developed by the Grassroots project, is the affected suite. No specific version range is listed in the advisory, meaning that any deployment of GDCM that has not been confirmed patched could be at risk. Updated releases and additional information can be obtained from the project's SourceForge page.
Risk and Exploitability
The CVSS score of 8.7 qualifies this flaw as high severity, and while an EPSS value is unavailable, its potential for causing out‑of‑memory conditions makes exploitation practically relevant. Because the fault is triggered during the parsing of a DICOM file, the likely attack vector is delivery of a crafted file through the DICOM service or via an application that imports or processes DICOM data. Without an official fix yet publicly disclosed, users should treat this as a high‑risk issue and proactively lock down or postpone usage of the affected library until a patched version is released.
Debian DLA