CVE-2025-52582: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-52582 is an out-of-bounds read vulnerability in the Overlay::GrabOverlayFromPixelData function of Grassroot DICOM (GDCM) version 3.0.24, a widely used C++ library for processing DICOM medical imaging files. A specially crafted DICOM file can trigger the flaw, leading to an information leak. The vulnerability was disclosed by Cisco Talos researcher Emmanuel Tacheau on December 16, 2025, following vendor disclosure on July 15, 2025. It carries a CVSS v3.1 base score of 7.4 (High) per Talos (Talos Advisory).

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) / CWE-125 (Out-of-bounds Read). In gdcmOverlay.cxx at line 283, the function computes an end pointer as array + length, where length is derived from ovlength * 8 * 1 (using Internal->Rows * Internal->Columns / 8) rather than the actual byte length of the pixel data buffer (bv->GetLength()). When a malformed DICOM file supplies mismatched Rows/Columns metadata versus the actual PixelData tag (0x7fe0,0x0010) size, the end pointer extends beyond the allocated buffer. The subsequent while(p != end) loop then reads out-of-bounds memory — demonstrated to reach into glibc's address space — causing a SIGSEGV and potentially leaking sensitive memory contents such as function pointers and memory layout information useful for further exploitation (Talos Advisory).

Successful exploitation results in an out-of-bounds memory read that can leak sensitive process memory, including glibc internals such as function pointers and heap metadata, which could facilitate ASLR bypass and further exploitation. The primary impact is high confidentiality loss; integrity and availability are not directly affected by the read primitive alone, though the crash (SIGSEGV) also causes a denial of service for the processing application. In medical imaging environments where GDCM is used to ingest patient DICOM files, an attacker supplying a malicious file could extract sensitive runtime information from the processing system (Talos Advisory).

Cisco Talos has published a detailed technical write-up (TALOS-2025-2211) that serves as a proof-of-concept reference, demonstrating the crash and out-of-bounds read condition. No evidence of in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), indicating a very low probability of near-term exploitation. Exploitation requires the attacker to supply a malicious DICOM file to a system running GDCM 3.0.24, which may occur via file upload interfaces, DICOM network services (C-STORE), or shared storage (Talos Advisory, Feedly).

1. Craft a malicious DICOM file: Create a DICOM file where the Rows and Columns metadata tags are set to large values (inflating ovlength = Rows * Columns / 8), while the actual PixelData tag (0x7fe0,0x0010) contains a much smaller byte buffer. This causes length = ovlength * 8 to exceed the real buffer size.
2. Deliver the file to the target: Submit the crafted DICOM file to any system or application using GDCM 3.0.24 for processing — e.g., via a DICOM C-STORE network operation, a web-based medical imaging upload portal, or by placing the file in a directory monitored by a GDCM-based application.
3. Trigger parsing: The application calls gdcm::ImageReader::Read(), which invokes PixmapReader::ReadImageInternal() → DoOverlays() → Overlay::GrabOverlayFromPixelData(), computing an inflated end pointer beyond the actual pixel data buffer.
4. Out-of-bounds read occurs: The while(p != end) loop at gdcmOverlay.cxx:283 iterates past the valid buffer, reading memory from adjacent regions (demonstrated to reach glibc's address space), leaking sensitive data such as function pointers and heap layout.
5. Collect leaked data: If the application reflects any processed output or error information, the attacker may extract leaked memory values to defeat ASLR or gather intelligence for a follow-on exploit (Talos Advisory).

• File System: Presence of anomalous DICOM files with unusually large Rows/Columns metadata values but small or mismatched PixelData content; unexpected DICOM files in upload or processing directories.
• Logs: Application crash logs or core dumps referencing gdcm::Overlay::GrabOverlayFromPixelData with SIGSEGV at gdcmOverlay.cxx:283; error messages such as "Could not find Pixel Data" or segmentation fault traces in GDCM-based application logs.
• Process: Unexpected termination (SIGSEGV/crash) of GDCM-based imaging applications after processing a DICOM file; child processes of medical imaging software exiting abnormally.
• Network: Unusual DICOM C-STORE requests delivering files with atypical metadata (very large image dimensions with small data payloads) from untrusted sources (Talos Advisory).

No official patch has been confirmed as available for Grassroot DICOM 3.0.24 at the time of disclosure. Recommended mitigations include: restricting DICOM file ingestion to trusted sources only; implementing strict input validation and sandboxing for DICOM file processing pipelines; monitoring for anomalous DICOM files with mismatched image dimension metadata and pixel data sizes; and limiting access to GDCM-based processing tools to authorized personnel. Organizations should monitor the GDCM SourceForge project for a patched release and apply it promptly when available (Talos Advisory).

Cisco Talos published a blog post covering this vulnerability alongside others discovered in libbiosig and Smallstep step-ca, providing broader context for the research (Talos Blog). The vulnerability was indexed by ENISA (EUVD-2025-203850) and picked up by security aggregators including Tenable (Nessus plugin 278965), VulDB, and INCIBE-CERT. Community discussion has been limited, with no significant social media controversy or major media coverage beyond standard vulnerability tracking outlets.