CVE-2026-3650: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-3650 is a memory leak vulnerability in the Grassroots DICOM (GDCM) library that allows unauthenticated remote attackers to trigger a denial-of-service condition by supplying a maliciously crafted DICOM file. The flaw affects GDCM version 3.2.2 and was publicly disclosed on March 24, 2026, via a CISA ICS Medical Advisory (ICSMA-26-083-01). It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (CISA Advisory, Red Hat Bugzilla). The vulnerability was reported to CISA by Volodymyr Bihunenko, Mykyta Mudryi, and Markiian Chaklosh of ARIMLABS (CISA Advisory).

The root cause is classified under CWE-401 (Missing Release of Memory after Effective Lifetime) and CWE-770 (Allocation of Resources Without Limits or Throttling). When GDCM parses DICOM files containing non-standard Value Representation (VR) types in the file meta information section, it allocates heap memory without properly releasing it, allowing a single malformed file to exhaust available heap space in one read operation (CISA Advisory, Red Hat Bugzilla). The attack vector is network-based, requires no authentication, no privileges, and no user interaction — any application that accepts and parses DICOM files using the GDCM library is exposed (CISA Advisory). No public proof-of-concept exploit code has been identified at this time (Feedly).

Successful exploitation results in heap exhaustion and a denial-of-service condition affecting any application or service that uses GDCM to parse DICOM files, with a HIGH availability impact and no confidentiality or integrity compromise. Given GDCM's widespread use in healthcare imaging systems and medical device software, exploitation could disrupt diagnostic imaging workflows in clinical environments (CISA Advisory). CISA has categorized this vulnerability under the Healthcare and Public Health critical infrastructure sector, with worldwide deployment scope (CISA Advisory). There is no evidence of lateral movement potential or data exfiltration risk, as the impact is limited to availability.

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported to CISA or observed in threat intelligence sources (CISA Advisory, Feedly). The EPSS score is approximately 0.049%, indicating a low probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the zero-precondition attack profile (no authentication, no user interaction, network-accessible) makes it straightforward to weaponize if a PoC is developed.

1. Reconnaissance: Identify network-accessible services or applications that accept DICOM file uploads and use the GDCM library version 3.2.2 (e.g., medical imaging servers, PACS systems, or DICOM processing endpoints).
2. Craft malformed DICOM file: Create a DICOM file with non-standard VR (Value Representation) types embedded in the file meta information section. The malformed VR types trigger the vulnerable code path in GDCM's parser.
3. Submit the crafted file: Deliver the malformed DICOM file to the target application via any supported intake mechanism — file upload interface, DICOM network protocol (DIMSE), or API endpoint that processes DICOM data.
4. Trigger heap exhaustion: Upon parsing, GDCM allocates large amounts of heap memory without releasing it. A single crafted file can fill the heap in one read operation, causing the host process to exhaust available memory.
5. Achieve denial-of-service: The target application or service crashes or becomes unresponsive due to resource depletion, disrupting availability of the imaging or medical system (CISA Advisory).

• Process Behavior: Rapid and sustained increase in heap memory consumption by the GDCM-linked application process (e.g., imaging server, PACS service) without a corresponding increase in legitimate workload.
• System Logs: Out-of-memory (OOM) killer events in Linux system logs (/var/log/syslog, dmesg) terminating the DICOM processing service; application crash logs referencing memory allocation failures.
• Network: Unusual or repeated submission of DICOM files from unexpected source IPs to DICOM-processing endpoints; anomalous DIMSE connection attempts delivering large or malformed files.
• File System: Presence of malformed DICOM files (with non-standard VR types in file meta information) in upload directories or temporary processing folders; files that cause the parser to hang or crash on inspection.
• Application Logs: GDCM parser error messages related to unrecognized or non-standard VR types in file meta information sections (CISA Advisory).

The GDCM maintainer has not responded to CISA's requests to coordinate on a patch; organizations should monitor the official GDCM SourceForge page for updated releases and apply patches as soon as they become available (CISA Advisory). Red Hat has tracked this issue and patched versions are expected through distribution channels — organizations using GDCM via Red Hat packages should apply available updates (Red Hat Bugzilla). As interim mitigations: restrict network access to DICOM-processing services using firewalls and network segmentation; implement file validation to reject malformed DICOM files with non-standard VR types before they reach the GDCM parser; and isolate DICOM processing services from broader clinical or business networks. Use VPNs for any required remote access to these systems (CISA Advisory).

CISA issued ICS Medical Advisory ICSMA-26-083-01 on March 24, 2026, flagging the vulnerability as affecting the Healthcare and Public Health critical infrastructure sector, which prompted coverage across multiple healthcare security outlets (CISA Advisory). Multiple healthcare-focused security publications including HIPAA Journal, HealthcareInfoSecurity, BankInfoSecurity, and DataBreachToday covered the advisory under the headline "CISA Flags Critical Flaw in Grassroots DICOM Imaging Library," highlighting the risk to medical imaging systems (Feedly). Paubox published a blog post titled "CISA Warns Flaw Could Crash Medical Imaging Systems," emphasizing the patient safety implications of availability disruptions in clinical imaging environments. Community discussion on Reddit (r/pwnhub) and Mastodon/Bluesky noted the zero-interaction attack profile as a concern for healthcare operators.