CVE-2025-48429
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data.
Risk Assessment
An attacker can provide a malicious DICOM file to trigger a heap data leak, potentially exposing sensitive information.
Recommendation
Update Grassroot DICOM to a version containing the fix, or avoid processing untrusted DICOM files until the patch is applied.
Other vulnerabilities in Grassroot DICOM
See all- CVE-2025-53619High
In Grassroot DICOM 3.024, there is an out-of-bounds read vulnerability in the JPEGBITSCodec::InternalCode functionality. A specially crafted DICOM file can lead to an information leak. The null_convert function is called based on the value of the malicious DICOM file specifying the intended interpretation of the image pixel data.
- CVE-2025-53618High
In Grassroot DICOM 3.024, there is an out-of-bounds read vulnerability in the JPEGBITSCodec::InternalCode functionality. A specially crafted DICOM file can lead to an information leak. The grayscale_convert function is called based on the value of the malicious DICOM file specifying the intended interpretation of the image pixel data.
- CVE-2025-52582High
An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak.
- CVE-2024-22373High
An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow.
Original NVD description (English source)
An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data. An attacker can provide a malicious file to trigger this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS