Description

Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-07T00:16:30.600Z",
  "pubdate": "2026-08-07T00:16:30.600Z",
  "executiveSummary": "This vulnerability involves a heap out-of-bounds write flaw triggered by processing maliciously crafted DICOM files containing malicious JPEG-compressed pixel data.\nThe primary impact of this vulnerability is remote code execution, allowing an attacker to execute arbitrary code within the context of the application processing the DICOM file.\nAffected systems include software applications and libraries capable of parsing and rendering DICOM medical imaging files with JPEG compression support.\nThe risk implications are severe, as successful exploitation could lead to full system compromise, data exfiltration, or lateral movement within clinical or enterprise networks.\nAn attacker possesses the capability to achieve remote code execution by delivering a specially crafted DICOM file to a victim or automated processing pipeline.\nExploitation requires user interaction or automated ingestion mechanisms to open or process the malicious DICOM file containing the malformed JPEG pixel data stream.",
  "technicalDetails": "The vulnerability resides in the pixel data decoding component responsible for handling JPEG-compressed DICOM image payloads.\nThe root cause is an improper bounds check or integer handling error during the parsing of JPEG-compressed pixel data, leading to an attacker-controlled heap out-of-bounds write condition.\nExploitation occurs step-by-step when an application parses a specially crafted DICOM file containing malicious JPEG structures.\nDuring the decoding of the JPEG-compressed pixel data, manipulated metadata or image dimensions cause the memory allocation routines to reserve insufficient buffer space on the heap.\nSubsequent write operations copy decoded image data past the boundaries of the allocated heap buffer, corrupting adjacent heap metadata and memory structures.\nAn attacker can leverage this heap corruption primitive to manipulate function pointers, virtual method tables, or critical application data structures.\nBy carefully crafting the malicious payload, the attacker redirects execution flow to malicious shellcode or initiates return-oriented programming chains.\nThe attack vector requires the delivery and opening of a crafted DICOM file, which can be executed remotely without prior authentication.\nNo specific privilege requirements are initially necessary, as the flaw can be triggered by standard users or unprivileged service accounts processing the medical imaging files.\nNetwork exposure depends on the deployment architecture, potentially affecting picture archiving and communication systems, medical imaging workstations, or web-based DICOM viewers exposed to untrusted inputs.\nPost-exploitation impact includes arbitrary code execution with the privileges of the vulnerable application, potentially granting access to sensitive patient health information and underlying system resources."
}