CVE-2025-11266: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-11266 is an out-of-bounds write vulnerability (CWE-787) in the Grassroots DICOM library (GDCM) that allows an attacker to crash applications by supplying a crafted malicious DICOM file. The vulnerability affects GDCM versions 3.0.24 and prior, SimpleITK versions 2.5.2 and prior, and medInria versions 4.0 and prior. It was reported by researcher Morgen Malinoski to CISA and publicly disclosed on December 11–12, 2025 via ICS Medical Advisory ICSMA-25-345-01. The CVSS v3.1 base score is 6.6 (Medium) and the CVSS v4.0 base score is 6.8 (Medium) (CISA Advisory, CISA CSAF).

The root cause is an unsigned integer underflow in buffer indexing during parsing of encapsulated PixelData fragments in DICOM files — compressed image data stored as multiple fragments (CWE-787: Out-of-bounds Write). When a malformed DICOM file with specially crafted fragment metadata is parsed, the underflow causes the library to compute an invalid buffer index, resulting in an out-of-bounds memory write and subsequent segmentation fault. No privileges are required, and the only precondition is that a user or application opens the crafted file; the vulnerability is not remotely exploitable without user interaction. A fix commit is publicly available at the GDCM GitHub repository (CISA Advisory, GDCM Commit).

Successful exploitation results in a denial-of-service condition: the affected application crashes due to a segmentation fault triggered by the out-of-bounds memory access. There is also a low confidentiality and low integrity impact, as the out-of-bounds write could theoretically expose or corrupt adjacent memory, though the primary observed effect is application termination. Given that GDCM is widely used in healthcare imaging software (including SimpleITK and medInria), exploitation could disrupt medical imaging workflows in Healthcare and Public Health critical infrastructure environments worldwide (CISA Advisory, CISA CSAF).

No known public exploitation specifically targeting this vulnerability has been reported to CISA, and the vulnerability is not remotely exploitable — it requires local file access and user interaction to open a crafted DICOM file (CISA Advisory). The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the wild in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No exploit kits, weaponized code, or threat actor attribution have been identified.

1. Craft a malicious DICOM file: Create a DICOM file with malformed encapsulated PixelData fragments where fragment length or offset metadata is manipulated to trigger an unsigned integer underflow during buffer index calculation in the GDCM parsing code.
2. Deliver the file to the target: Use social engineering (e.g., phishing email with the malicious DICOM file as an attachment, or placing the file in a shared medical imaging directory) to get a user or automated imaging application to open the file.
3. Trigger parsing: The target user or application opens the crafted DICOM file using software that relies on GDCM (e.g., medInria, a SimpleITK-based tool, or any GDCM-linked imaging application).
4. Achieve denial-of-service: GDCM's PixelData fragment parser computes an invalid buffer index due to the underflow, performs an out-of-bounds write, and the application crashes with a segmentation fault, resulting in a denial-of-service condition (CISA Advisory, CISA CSAF).

• File System: Presence of unexpected or unsolicited DICOM files (.dcm) in imaging directories, particularly files with anomalous PixelData fragment structures or unusually small/zero fragment lengths.
• Logs: Application crash logs or core dump files generated by GDCM-linked applications (e.g., medInria, SimpleITK-based tools) referencing segmentation faults; system logs showing abnormal process termination (signal 11/SIGSEGV) for imaging applications.
• Process: Unexpected termination of medical imaging application processes; repeated crash-restart cycles of GDCM-dependent services after processing a specific DICOM file.
• Network: Delivery of DICOM files via email attachments or file shares from unexpected or external sources, particularly to systems running unpatched GDCM versions (CISA Advisory).

The GDCM maintainer recommends updating to GDCM v3.2.2 or later, available from the official GitHub repository. SimpleITK and medInria have also released fixes for this vulnerability. As interim defensive measures, CISA recommends minimizing network exposure for affected systems, isolating control system networks behind firewalls, and avoiding opening DICOM files from untrusted or unsolicited sources. Users should not click links or open attachments in unsolicited emails that may deliver malicious DICOM files (CISA Advisory, GDCM v3.2.2 Release).

The vulnerability received coverage in healthcare-focused security outlets, including HIPAA Journal and Paubox, highlighting the risk to medical imaging workflows in healthcare environments. A Reddit post in r/pwnhub noted the medium-severity rating and the patch availability. Researcher Morgen Malinoski, who discovered and reported the vulnerability to CISA, briefly discussed it on Infosec.exchange (Mastodon). Overall community sentiment reflects moderate concern given the healthcare sector impact, tempered by the local-only attack vector and the availability of a patch (HIPAA Journal, Paubox).