CVE-2025-53619
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
In Grassroot DICOM 3.024, there is an out-of-bounds read vulnerability in the JPEGBITSCodec::InternalCode functionality. A specially crafted DICOM file can lead to an information leak. The null_convert function is called based on the value of the malicious DICOM file specifying the intended interpretation of the image pixel data.
Risk Assessment
An attacker could exploit this vulnerability to read out-of-bounds data, potentially exposing sensitive information from process memory.
Recommendation
Upgrade Grassroot DICOM to the latest version with a fix or avoid opening untrusted DICOM files.
Other vulnerabilities in Grassroot DICOM
See all- CVE-2025-53618High
In Grassroot DICOM 3.024, there is an out-of-bounds read vulnerability in the JPEGBITSCodec::InternalCode functionality. A specially crafted DICOM file can lead to an information leak. The grayscale_convert function is called based on the value of the malicious DICOM file specifying the intended interpretation of the image pixel data.
- CVE-2025-52582High
An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak.
- CVE-2025-48429High
An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data.
- CVE-2024-22373High
An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow.
Original NVD description (English source)
An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `null_convert` is called based of the value of the malicious DICOM file specifying the intended interpretation of the image pixel data
Vulnerability data from NVD (NIST) · CISA KEV · EPSS