CVE-2024-24793: 
Homebrew vulnerability analysis and mitigation

A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5. A specially crafted DICOM file can cause premature freeing of memory that is used later. The vulnerability affects the File Meta Information header parsing functionality. To trigger this vulnerability, an attacker would need to induce the vulnerable application to process a malicious DICOM image (Talos Intelligence).

The vulnerability occurs in the parsing of DICOM file elements where a double-free condition can be triggered. When processing elements with the same tag in the File Meta Information header, the code first frees the element in dcm_dataset_insert() and then attempts to free it again in parse_meta_element_create(). The vulnerability has been assigned a CVSSv3 score of 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-416 (Use After Free) (Talos Intelligence).

The vulnerability can lead to memory corruption and possible arbitrary code execution on the targeted system. When exploited, it can cause the application to crash, as demonstrated by both ASAN-instrumented builds and regular builds of the library (Talos Intelligence).

The vendor has issued a fix on Github.com. Users should update to the latest version of the library that contains the patch (Talos Intelligence).