External risk intelligence

Grassroots DICOM JPEG2000 Decode Heap Overflow

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-22373

Grassroots DICOM is a software library used for processing medical imaging files. It is typically integrated into specialized clinical or research applications for local file parsing. It is not designed to be an internet-facing service, edge gateway, or public web application, making public internet exposure of this library in common deployment patterns very unlikely.

Memory Corruption

Malaterre Grassroots Dicom

3.0.23383940

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the processing of certain medical image files, potentially allowing unauthorized access and manipulation. This issue affects software used for handling DICOM files, a standard format for medical imaging. The primary concern is to confirm if our environment utilizes this specific software for file processing.

Flaw affects medical image file processing.
Matters if we use affected software.
Confirm usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by providing a specially crafted DICOM file. This file, when processed by the vulnerable JPEG2000 decoding functionality, could cause a heap buffer overflow. This overflow could lead to critical impacts on system integrity and availability.

No specific access required.
Triggered by a malicious DICOM file.
Enables arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A heap buffer overflow could occur when processing a specially crafted DICOM file with a specific software component, potentially affecting system stability and allowing for arbitrary code execution when supported by the advisory.

System data and service availability at risk.
Malicious DICOM file processing can trigger overflow.
Potential for arbitrary code execution and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that Grassroots DICOM is a library for processing DICOM files, the application owners responsible for the software that incorporates this library are the primary point of contact. The first practical step is to identify all systems where this library is deployed, confirm its reachability, and assess business criticality to prioritize remediation efforts.

Application owners should manage this issue.
Verify affected applications and their reachability.
Plan and coordinate remediation activities.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Grassroots DICOM?

Grassroots DICOM (GDCM) is a C++ software library used by developers to read and write DICOM files, which are the standard format for medical images like X-rays, MRIs, and CT scans. It provides the essential tools for clinical and research applications to decode and display these complex images. Because it is a library, it is usually embedded within larger medical imaging software rather than running as a standalone program.

What does CVE-2024-22373 mean?

This is a heap buffer overflow vulnerability, categorized under CWE-119 and CWE-787. In plain terms, the software makes a mistake when calculating how much memory to set aside while decoding a JPEG2000 image inside a DICOM file. If a file is designed to exploit this, it can write data into memory regions it shouldn't access, which can crash the application or potentially allow an attacker to run their own unauthorized commands.

How is this vulnerability triggered?

An attacker must supply a specially crafted DICOM file to the vulnerable software for processing. The vulnerability resides specifically within the JPEG2000 decoding component. Simply having the library installed or merely viewing benign, standard medical images will not trigger the bug; the system must attempt to parse a malicious file that intentionally violates expected data structures to cause the overflow.

Is this a risk for internet-facing systems?

According to Halo Surface Signal, this is very unlikely. Grassroots DICOM is a backend library designed for processing local files within specialized clinical applications, not as a public-facing web service or edge gateway. The risk is highest in systems specifically configured to automatically ingest, process, or render external, untrusted medical image files from unknown sources.

What should I do if I use this software?

Since this is a library, you should check your inventory for any applications that depend on Grassroots DICOM version 3.0.23. Your first step is to identify where this library is integrated within your environment. Once identified, consult your software vendors or internal developers to determine if an update is available for the application itself, as they are responsible for updating the embedded components to a patched version.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.