External risk intelligence

Grassroots DICOM Out-of-Bounds Read Heap Leak

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-48429

Grassroots DICOM is a software library used for processing medical imaging files. While it can be integrated into network-connected applications, it is typically used for local file processing or within internal healthcare imaging systems. Public internet exposure of the codec library itself is uncommon, as it is generally a dependency within specialized backend software.

Memory Corruption

Malaterre Grassroots Dicom

3.0.24

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a vulnerability in Grassroots DICOM, a software library for medical imaging files. The issue, an out-of-bounds read, could allow a specially crafted file to leak sensitive heap data, potentially impacting the confidentiality of information processed by affected systems. The main concern is confirming the relevance and exposure of this library within your specific environments.

Sensitive data may be exposed.
Understand potential exposure to medical imaging data.
Confirm if this library is used and assess impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by providing a specially crafted DICOM file. This malicious file, when processed by the vulnerable Grassroots DICOM library, could lead to the exposure of sensitive information from the application's memory.

Network access required.
Malicious DICOM file triggers vulnerability.
Heap data leakage possible.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a specially crafted DICOM file could cause an out-of-bounds read in the RLECodec::DecodeByStreams functionality, potentially leaking heap data.

DICOM heap data may be exposed.
Via a maliciously crafted DICOM file.
Application instability or data leakage.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Grassroots DICOM library's RLECodec component is susceptible to an out-of-bounds read vulnerability when processing specially crafted DICOM files, potentially leading to heap data leakage. This impacts application owners and infrastructure teams responsible for systems that process DICOM files. The first step is to identify all instances of Grassroots DICOM, confirm their reachability and criticality, and then engage the accountable owner for remediation planning based on risk.

Application or platform teams should own.
Verify DICOM file processing exposure.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Grassroots DICOM used for?

Grassroots DICOM is a software library designed to handle and process medical imaging files. It serves as a foundational component for various healthcare applications, enabling them to read and interpret the DICOM (Digital Imaging and Communications in Medicine) format. Developers integrate this library into their software to ensure compatibility when managing complex imaging data across clinical and diagnostic systems.

What does CVE-2025-48429 mean by out-of-bounds read?

This vulnerability, classified as an out-of-bounds read (CWE-125), occurs when the software reads data past the intended end of a memory buffer. In the context of CVE-2025-48429, the RLECodec component incorrectly processes specifically structured DICOM files. This memory error allows the application to inadvertently leak sensitive information stored in its heap memory, which could otherwise remain private.

How is this vulnerability triggered?

An attacker triggers this bug by providing a maliciously crafted DICOM file to a system using the vulnerable library. The vulnerability is specifically located within the RLECodec::DecodeByStreams function. It is important to note that simply having the library installed is not enough; the bug only manifests when the software actively attempts to decode a specially manipulated file.

Do I need to worry about this vulnerability?

Your concern level depends on how your systems interact with medical files. According to Halo Surface Signal, Grassroots DICOM is often a backend dependency rather than a standalone, internet-facing service. While the vulnerability has a network attack vector, it is less common to find this library directly exposed to the public internet compared to internal medical imaging environments.

What are the first steps for managing this risk?

Begin by auditing your infrastructure to locate all applications that utilize the Grassroots DICOM library. Once identified, evaluate how those applications process external files and whether they handle data from untrusted sources. Coordinate with your application and platform teams to document these integrations and prepare a plan to update the library once a vendor-provided fix becomes available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.