Skip to content
OpenAdvisories
Medium · 6.6 CVE-2025-11266 EUVD-2025-203169GHSA-7qcj-ww2g-7w6j

Grassroots DICOM (GDCM) Out-of-bounds Write

Published Dec 12, 2025 · Updated Jan 20, 2026 · Assigned by icscert

Description

An out-of-bounds write vulnerability exists in the Grassroots DICOM library (GDCM). The issue is triggered during parsing of a malformed DICOM file containing encapsulated PixelData fragments (compressed image data stored as multiple fragments). This vulnerability leads to a segmentation fault caused by an out-of-bounds memory access due to unsigned integer underflow in buffer indexing. It is exploitable via file input, simply opening a crafted malicious DICOM file is sufficient to trigger the crash, resulting in a denial-of-service condition.

Affected products

VendorProductAffectedFixed
Grassroots DICOM (GDCM) ≤ 3.0.24 —
NumFocus SimpleITK ≤ 2.5.2 —
medInria medInria ≤ 4.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 gdcm 3.0.24-11 —
Debian 13 gdcm No fix yet —
Debian 12 gdcm No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 25.10 gdcm No fix yet —
Ubuntu 24.04 LTS gdcm No fix yet —
Ubuntu 22.04 LTS gdcm No fix yet —
Ubuntu 20.04 LTS gdcm No fix yet —
Ubuntu 18.04 LTS gdcm No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS gdcm No fix yet —
Ubuntu Pro 14.04 LTS gdcm No fix yet —

Advisories 1

References