CVE-2025-25472: 
NixOS vulnerability analysis and mitigation

A buffer overflow vulnerability was identified in DCMTK git master version 3.6.9+ DEV. The vulnerability was assigned CVE-2025-25472 and was discovered in February 2025. The issue affects the DCMTK (DICOM Toolkit) software, which is widely used for handling DICOM medical imaging files (CVE Mitre, Debian Tracker).

The vulnerability is a buffer overflow condition that occurs when processing DCM files in DCMTK. The issue specifically relates to the handling of invalid monochrome DICOM images where the number of pixels stored does not match the expected number of pixels. The vulnerability was introduced as a side effect of fixing another vulnerability (CVE-2024-47796) and was later addressed in commit 410ffe2019b9db6a8f4036daac742a6f5e4d36c2 (DCMTK Git).

When successfully exploited, this vulnerability allows attackers to cause a Denial of Service (DoS) condition through the use of a specially crafted DCM file (CVE Mitre).

The vulnerability has been fixed in DCMTK version 3.6.9-4 for some distributions. Debian has addressed this in their bookworm release with version 3.6.7-9~deb12u3 and in sid/trixie with version 3.6.9-4. Users are advised to upgrade to the fixed versions (Debian Tracker).