PT-2026-97802 · Dcmtk · Dcmtk
CVSS v4.0
8.8
عالية
| المتجه | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
DCMTK versions prior to 3.7.1
Description
A heap over-read occurs in the ConcatenationLoader when copying pixel data frames. The issue arises because the software fails to validate the
PixelData buffer length against the declared NumberOfFrames. An attacker can use a specially crafted DICOM instance that declares more frames than the buffer actually contains, leading to an application crash or the leakage of adjacent heap memory.Recommendations
Update to a version newer than 3.7.0.
استغلال
إصلاح
Out of bounds Read
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Dcmtk