CVE-2024-22373
HighCVSS 8.1Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow.
Risk Assessment
Risk of remote code execution or application crash when processing DICOM files.
Recommendation
Update Grassroot DICOM to the latest patched version and avoid opening untrusted DICOM files.
Other vulnerabilities in Grassroot DICOM
See all- CVE-2025-53619High
In Grassroot DICOM 3.024, there is an out-of-bounds read vulnerability in the JPEGBITSCodec::InternalCode functionality. A specially crafted DICOM file can lead to an information leak. The null_convert function is called based on the value of the malicious DICOM file specifying the intended interpretation of the image pixel data.
- CVE-2025-53618High
In Grassroot DICOM 3.024, there is an out-of-bounds read vulnerability in the JPEGBITSCodec::InternalCode functionality. A specially crafted DICOM file can lead to an information leak. The grayscale_convert function is called based on the value of the malicious DICOM file specifying the intended interpretation of the image pixel data.
- CVE-2025-52582High
An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak.
- CVE-2025-48429High
An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data.
Original NVD description (English source)
An out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS