CVE catalog

CVE-2024-25569

gdcm: CVE-2024-25569

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Published
Source
[NVD] · [CVE record]
EPSS
1.08% · Oct 25, 2026

An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiangdcmsid3.0.24-14fixed
Debiangdcmforky3.0.24-14fixed
Debiangdcmtrixie3.0.24-5fixed
Debiangdcmbookworm3.0.21-1vulnerable
Ubuntugdcmpro2.2.3-2ubuntu3vulnerable
Ubuntugdcmpro2.2.3-2ubuntu4vulnerable
Ubuntugdcmpro2.2.4-1.1ubuntu1vulnerable
Ubuntugdcmpro2.2.4-1.1ubuntu2vulnerable
Ubuntugdcmpro2.2.4-1.1ubuntu3vulnerable
Ubuntugdcmpro2.2.4-1.1ubuntu4vulnerable
Ubuntugdcmpro2.2.4-1.1ubuntu4+esm1vulnerable
Ubuntugdcm16.042.4.4-4vulnerable
Ubuntugdcm16.042.4.4-4build1vulnerable
Ubuntugdcm16.042.4.4-4ubuntu1vulnerable
Ubuntugdcm16.042.6.1-3vulnerable
Ubuntugdcm16.042.6.2-1vulnerable
Ubuntugdcm16.042.6.2-2vulnerable
Ubuntugdcm16.042.6.2-3vulnerable
Ubuntugdcm16.042.6.3-1vulnerable
Ubuntugdcm16.042.6.3-1ubuntu1vulnerable
Ubuntugdcm16.042.6.3-2ubuntu1vulnerable
Ubuntugdcm16.042.6.3-3ubuntu1vulnerable
Ubuntugdcm16.042.6.3-3ubuntu3vulnerable
Ubuntugdcm18.042.8.2-3build1vulnerable
Ubuntugdcm18.042.8.3-1vulnerable
Ubuntugdcm18.042.8.4-1vulnerable
Ubuntugdcm18.042.8.4-1build2vulnerable
Ubuntugdcm20.042.8.8-9ubuntu4vulnerable
Ubuntugdcm20.042.8.8-9ubuntu5vulnerable
Ubuntugdcm20.043.0.4-2vulnerable
Ubuntugdcm20.043.0.4-2build1vulnerable
Ubuntugdcm20.043.0.4-2ubuntu1vulnerable
Ubuntugdcm20.043.0.5-1ubuntu1vulnerable
Ubuntugdcm20.043.0.5-1.1ubuntu1vulnerable
Ubuntugdcm20.043.0.5-1.1ubuntu2vulnerable
Ubuntugdcm22.043.0.8-2vulnerable
Ubuntugdcm22.043.0.10-1vulnerable
Ubuntugdcm22.043.0.10-1build2vulnerable
Ubuntugdcm24.043.0.21-2vulnerable
Ubuntugdcm24.043.0.22-1vulnerable
Ubuntugdcm24.043.0.22-2build1vulnerable
Ubuntugdcm24.043.0.22-2build2vulnerable
Ubuntugdcm24.043.0.22-2.1build1vulnerable
Ubuntugdcm24.043.0.22-2.1build2vulnerable
Ubuntugdcm24.043.0.22-2.1ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiangdcmsourcesid3.0.24-1not yet assignedNot reported[1070387]
Debiangdcmsourceforky3.0.24-1not yet assignedNot reported[1070387]
Debiangdcmsourcetrixie3.0.24-1not yet assignedNot reported[1070387]
Debiangdcmsourcebookworm(unfixed)not yet assignedNot reported[1070387]

[Debian bug #1070387]

Notes

[bookworm] gdcm: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]