CVE-2025-53619: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-53619 is an out-of-bounds read vulnerability in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM (GDCM) version 3.0.24, a widely used C++ library for processing DICOM medical imaging files. The flaw is triggered when a specially crafted DICOM file causes the null_convert color conversion function to read beyond the bounds of an allocated memory buffer, potentially leading to an information leak. It was discovered by Emmanuel Tacheau of Cisco Talos, disclosed to the vendor on 2025-07-15, and publicly released on 2025-12-16. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) per Talos, though NVD rates it 9.1 (Critical) (Talos Advisory).

The root cause is classified as CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-125 (Out-of-bounds Read). Within JPEGBITSCodec::InternalCode, the input pixel buffer is allocated based on the pixel data size declared in the DICOM file header, but no bounds check is performed at line 286 before computing row_pointer[0] = &image_buffer[cinfo.next_scanline * row_stride]. This out-of-bounds pointer is then passed through jpeg_write_scanlines → process_data_simple_main → pre_process_data, ultimately reaching the null_convert function (CVE-2025-53619) or grayscale_convert function (CVE-2025-53618), where the out-of-bounds read occurs at inptr[ci] / inptr[0]. The attack vector is network-based (an attacker supplies a malicious DICOM file), requires no authentication or user interaction, and exploits attacker-controlled fields such as PhotometricInterpretation, image_width, input_components, and num_rows embedded in the DICOM file (Talos Advisory).

Successful exploitation can result in sensitive information disclosure (high confidentiality impact) by leaking memory contents adjacent to the image buffer, as well as application crashes causing denial of service (high availability impact). Because GDCM is used in medical imaging pipelines — including PACS servers, radiology workstations, and clinical software — exploitation could expose patient data or disrupt critical healthcare systems. There is no integrity impact, but the combination of information leakage and availability disruption in a healthcare context makes this vulnerability particularly significant (Talos Advisory).

1. Reconnaissance: Identify systems running Grassroot DICOM 3.0.24 — this may include PACS servers, DICOM viewers, or medical imaging applications. Network scanning tools or service banners may reveal DICOM-capable endpoints (typically port 104/11112).
2. Craft malicious DICOM file: Create a DICOM file with manipulated header fields: set PhotometricInterpretation to RGB (to trigger null_convert), and configure image_width, SamplesPerPixel, BitsAllocated, and pixel data size such that the declared image dimensions exceed the actual pixel data buffer length.
3. Deliver the file: Submit the crafted DICOM file to the target system via a DICOM network operation (e.g., C-STORE), a web upload interface, or any other file ingestion mechanism that invokes GDCM's JPEG compression pipeline.
4. Trigger the vulnerability: When the application processes the file and attempts JPEG compression via ImageChangeTransferSyntax::Change() → JPEGBITSCodec::InternalCode, the null_convert function reads beyond the allocated pixel buffer at inptr[ci].
5. Achieve objective: The out-of-bounds read leaks adjacent heap memory contents (potential information disclosure) and/or causes a SIGSEGV crash (denial of service) (Talos Advisory).

• Network: Unexpected or malformed DICOM C-STORE requests (port 104/11112) from untrusted sources; DICOM files submitted with unusual PhotometricInterpretation values (e.g., RGB with SamplesPerPixel=1) or mismatched pixel data sizes.
• File System: Presence of DICOM files with anomalous header fields — specifically PhotometricInterpretation: RGB combined with SamplesPerPixel: 1, or declared image dimensions (width × height × components) significantly exceeding actual pixel data length.
• Logs: Application crash logs or core dumps referencing null_convert, grayscale_convert, JPEGBITSCodec::InternalCode, or gdcm::ImageChangeTransferSyntax::Change; SIGSEGV signals from GDCM-based processes.
• Process: Unexpected termination or segmentation faults in DICOM processing services (e.g., PACS server processes, gdcmconv, or applications linking against libgdcm) (Talos Advisory).

No official patch has been released for Grassroot DICOM 3.0.24 as of the public disclosure date. Recommended interim mitigations include: (1) restricting DICOM file ingestion to trusted, authenticated sources only; (2) implementing network segmentation to limit exposure of systems running GDCM; (3) validating DICOM file headers (particularly PhotometricInterpretation, SamplesPerPixel, and pixel data size consistency) before passing files to GDCM for processing; (4) monitoring for anomalous DICOM submissions and application crashes; and (5) upgrading to a patched version of Grassroot DICOM when one becomes available from the vendor (Talos Advisory).

Cisco Talos published the full technical advisory (TALOS-2025-2210) on December 16, 2025, crediting Emmanuel Tacheau as the discoverer. The vulnerability was also covered in the Talos Intelligence blog post discussing multiple vulnerabilities including libbiosig and smallstep/step-ca. RedPacket Security and CIRCL's vulnerability lookup service aggregated and redistributed the advisory. Community discussion was limited, with mentions on Mastodon and Bluesky primarily consisting of automated CVE alert posts (Talos Blog, Talos Advisory).