Executive brief
A vulnerability exists in the vtk-dicom library, which is used by medical imaging applications to process and display CT and MRI scans. By providing a specially crafted DICOM image file, an attacker could cause the application to crash or potentially execute unauthorized code. This could lead to service disruptions or the compromise of sensitive medical data handled by the software.
Technical details
A heap-based buffer overflow exists in the vtk-dicom library (version 9.5.2) within the vtkDICOMItem::FindDataElementOrInsert function. The vulnerability is caused by improper validation of an array index (CWE-129), where an incremented value exceeds the allocated array size during the processing of DICOM data elements. An attacker can exploit this by providing a maliciously crafted DICOM file, leading to an out-of-bounds write that corrupts heap chunk metadata. This corruption can result in a denial-of-service (crash) or potentially arbitrary code execution. The attack requires the victim to process the malicious file, and while it can be delivered over a network, the complexity is rated as high.
Affected products
- vtk vtk-dicom 9.5.2
Timeline
- 2026-06-25: disclosed: Vulnerability reported by Cisco Talos
- 2026-06-25: advisory