CVE-2025-48429: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-48429 is an out-of-bounds read vulnerability in the RLECodec::DecodeByStreams function of Grassroot DICOM (GDCM) version 3.0.24, a widely used C++ library for processing DICOM medical imaging files. A specially crafted DICOM file can trigger the flaw, leading to heap data leakage and potential denial of service. The vulnerability was discovered by Emmanuel Tacheau of Cisco Talos, disclosed to the vendor on July 15, 2025, and publicly released on December 16, 2025 (Talos Advisory). It carries a CVSSv3.1 score of 7.4 (High) per Talos, though Feedly's aggregated data also references a score of 9.1 (Critical) under a different vector (Talos Advisory).

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-125 (Out-of-bounds Read). In RLECodec::DecodeByStreams, the numSegments value is read directly from the attacker-controlled frame.Header.NumSegments field in the DICOM file without validation against the fixed-size Offset[15] array in RLEHeader. When numSegments exceeds 15 (e.g., a crafted value of 0x800002), the subsequent for loop at line 804 of gdcmRLECodec.cxx accesses memory beyond the array bounds, causing a segmentation fault and leaking heap contents. The call chain is: ImageReader::ReadImage → PixmapReader::ReadImageInternal → Bitmap::TryRLECodec → RLECodec::Decode → RLECodec::DecodeByStreams (Talos Advisory).

Successful exploitation can result in heap memory disclosure, potentially exposing sensitive data processed by the DICOM library (e.g., patient records or imaging metadata in medical environments), as well as a denial of service via application crash. Because GDCM is a library used across Python, C#, Java, and PHP applications, the impact extends to any software stack that processes untrusted DICOM files using this library. No integrity impact is expected from this specific vulnerability, but the confidentiality and availability impacts are rated High (Talos Advisory).

1. Craft a malicious DICOM file: Create a DICOM file with RLE transfer syntax where the NumSegments field in the RLE header is set to a value greater than 15 (e.g., 0x800002), exceeding the bounds of the fixed-size Offset[15] array in RLEHeader.
2. Deliver the file: Provide the malicious DICOM file to a target system running Grassroot DICOM 3.0.24 — this could be via a file upload interface, a DICOM network service (C-STORE), or any application that automatically processes incoming DICOM files.
3. Trigger parsing: The application calls ImageReader::ReadImage, which eventually invokes RLECodec::DecodeByStreams. The function reads numSegments from the file without bounds checking.
4. Out-of-bounds read occurs: The for loop iterates up to numSegments times, accessing frame.Header.Offset[i] beyond the 15-element array boundary, reading adjacent heap memory.
5. Collect leaked data or cause crash: Depending on the application's error handling, heap contents adjacent to the RLEHeader structure may be exposed (e.g., via error messages or network responses), or the application crashes with SIGSEGV, achieving denial of service (Talos Advisory).

• File System: Presence of anomalous DICOM files with unusually large NumSegments values (>15) in the RLE header; files that trigger crashes when processed by GDCM-based applications.
• Logs: Application crash logs or core dumps referencing gdcm::RLECodec::DecodeByStreams at gdcmRLECodec.cxx:804; SIGSEGV signals from GDCM-based processes.
• Process: Unexpected termination (segmentation fault) of applications using GDCM when processing specific DICOM files; repeated crashes of DICOM processing services upon receiving files from external sources.
• Network: Unusual DICOM C-STORE requests delivering files with malformed RLE headers to DICOM-enabled services (Talos Advisory).

As of the public disclosure date (December 16, 2025), no official patch has been released by the Grassroot DICOM project for version 3.0.24 (Talos Advisory). Recommended interim mitigations include: (1) restricting DICOM file processing to trusted, validated sources only; (2) implementing input validation to reject DICOM files with NumSegments values exceeding 15 before passing them to GDCM; (3) deploying sandboxed or isolated environments for DICOM file handling; (4) applying network-level controls to limit exposure of DICOM services to untrusted networks; and (5) monitoring GDCM-based applications for unexpected crashes. Users should check the Grassroot DICOM SourceForge project for updated releases.

Cisco Talos published the full technical advisory (TALOS-2025-2214) on December 16, 2025, including crash analysis and debugger output, and credited Emmanuel Tacheau as the discoverer (Talos Advisory). A Talos blog post covering this and related vulnerabilities (libbiosig, smallstep step-ca) was also published (Talos Blog). Community tracking was noted on vulnerability aggregators including CIRCL, VulDB, and INCIBE-CERT, with limited broader social media discussion given the specialized nature of the affected library.