External risk intelligence

Grassroots DICOM Out-of-Bounds Read Information Leak

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-53619

Grassroots DICOM is a software library used for processing medical imaging files. Vulnerabilities in such libraries are typically triggered by local processing of files (such as by desktop-based medical imaging viewers or specialized software) rather than by direct exposure of the library's functions to the public internet. It does not represent a network-facing service or appliance.

Memory Corruption

Malaterre Grassroots Dicom

3.0.24

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Grassroots DICOM software that could allow unauthorized individuals to access sensitive information through specially crafted image files. This issue impacts the processing of DICOM files, a standard for medical imaging. The primary concern is to confirm whether this technology is in use and if exposure has occurred.

Out-of-bounds read in medical imaging software.
Information leak possible via malicious DICOM files.
Confirm relevance and exposure for this technology.

Attack Path

How an attacker could exploit the issue

An attacker could send a specially crafted DICOM file to a system processing it, triggering an out-of-bounds read within the `JPEGBITSCodec::InternalCode` functionality. This could result in an information leak.

No user interaction required.
Malicious DICOM file processing.
Potential information disclosure and denial of service.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in Grassroot DICOM could allow an attacker to read sensitive information from memory by providing a specially crafted DICOM file. This occurs when the `InternalCode` functionality improperly handles image pixel data interpretation, potentially leading to an information leak under specific conditions.

Potentially sensitive memory contents.
Processing a malicious DICOM file.
Disclosure of unintended information.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that Grassroots DICOM is a software library for processing medical imaging files, ownership likely falls to teams responsible for applications that ingest or process DICOM data, such as platform or application owners. The first practical step is to identify all systems that utilize this library, assess their business criticality and exposure, and then confirm the accountable owner to plan remediation within a maintenance window.

Application or platform owners should own this.
Verify DICOM processing systems and criticality.
Plan remediation or vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Grassroots DICOM?

Grassroots DICOM is a software library used to process medical imaging files. It follows the DICOM standard, which allows various healthcare systems to manage, store, and share medical images like X-rays or MRIs. Developers integrate this library into applications—such as imaging viewers or diagnostic tools—to handle the complex data formats required to display and interpret medical scans.

What does CVE-2025-53619 mean?

This CVE identifies an out-of-bounds read vulnerability, categorized as CWE-125 and CWE-119. In plain terms, the software reads memory beyond the designated buffer boundaries when processing image data. Because of a flaw in the `JPEGBITSCodec::InternalCode` function, the library may access and leak sensitive information residing in memory instead of stopping at the expected end of the data.

How is this vulnerability triggered?

An attacker triggers this flaw by providing a specially crafted DICOM file to an application that uses the affected library. The vulnerability manifests when the software calls the `null_convert` function based on instructions within that malicious file. It is not triggered by standard, non-malicious medical images; the file must be intentionally designed to exploit the library's improper handling of pixel data interpretation.

Is my system at risk?

Halo Surface Signal indicates that risk is very unlikely because Grassroots DICOM is a library, not a network-facing service or standalone appliance. It typically runs as part of local medical imaging software. You should prioritize systems that ingest files from untrusted sources, as the primary concern is the processing of a malicious file rather than direct exposure to the public internet.

How do I respond to this threat?

Start by identifying all internal applications and systems that utilize the Grassroots DICOM library to process image data. Once identified, evaluate the business criticality of those systems. Coordinate with the relevant platform or application owners to confirm the library's presence and plan for updates or vendor patches within your standard maintenance cycles.

References

talosintelligence.com/vulnerability_reports/TALOS-2025-2210

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.