bad-dicom

Bad-DICOM 私が手作りしたCVE-2019-11687のエクスプロイトツールのPoC。 このPEDICOMは、大学のキャップストーン「 DICOMファイルの脆弱性に基づく、医療管理サービスに対する攻撃の検出と防止 」の概念実証として作成しました。 PEDICOMとは DoomDicom.dcmはPEDICOMであり、機能的なPEとしても、同時に正当なDICOMとしても動作可能なポリグロットファイルです。このファイルの詳細については、d00rtの原著論文をお読みください。 使い方 このファイルは主に2つの方法で開けます。 1. DCMとして: DicomViewer や...

CVE-2026-23009-DICOM-Network-Image-Injection-Without-Authentication

CVE-2026-23009 – 認証なしのDICOMネットワーク画像注入 プログラムコード Python pydicom dicomserversim.py - DICOM C-STORE SCP with no AE title check from pynetdicom import AE, evt, AllStoragePresentationContexts def handlestoreevent: ds = event.dataset No authentication, accepts any image from any remote...

CVE-2024-42845-Exploit

CVE-2024-42845：Invesalius 3.1 中的远程代码执行（RCE）漏洞 漏洞利用详情 漏洞利用标题 ：Invesalius 3.1 - 远程代码执行（RCE） 发现者 ：Alessio Romano sfoffo、Riccardo Degli Esposti partywave 漏洞利用作者 ：Alessio Romano sfoffo、Riccardo Degli Esposti partywave 日期 ：2024-08-23 厂商主页 ：Invesalius 软件链接 ：Invesalius GitHub 仓库 版本 ：3.1.99991 至 3.1.99998...

CVE-2026-25860

CVE-2026-25860 OpenClinic GA 5.247.01 の DICOM 画像アップロードハンドラを介した反射型 XSS この XSS を RCE に連鎖させたい場合は、以下を参照してください: https://www.partywave.site/show/research/cve-2026-25860-openclinic-ga-xss-to-rce 説明 OpenClinic GA = v5.351.19 12/05/2026 には、DICOM 画像アップロードハンドラに反射型クロスサイトスクリプティングの脆弱性が存在し、攻撃者が DICOM...

DEBIAN-CVE-2026-97059

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

EUVD-2026-85885

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059: Out-of-bounds Read

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

Astra Linux – Vulnerability in gdcm

There is an out-of-bounds write vulnerability in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in dcmtk

It was discovered that DCMTK v3.6.9+DEV contains a buffer overflow issue through the component /dcmimgle/diinpxt.h...

Astra Linux – Vulnerability in dcmtk

A security vulnerability has been detected in DCMTK up to version 3.6.5. The affected element is the parseQuota function of the dcmqrscp component. Manipulating the StorageQuota argument leads to a stack-based buffer overflow. Access to local resources is required to exploit this vulnerability. T...

Astra Linux – Vulnerability in dcmtk

A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service DoS attack through a crafted DICOM file...

Astra Linux – Vulnerability in dcmtk

The service class provider SCP of OFFIS DCMTK all versions prior to 3.6.7 is vulnerable to path traversal attacks, allowing attackers to write DICOM files into arbitrary directories under controlled names. This could enable remote code execution...

Astra Linux – Vulnerability in gdcm

There is a heap-based buffer overflow vulnerability in the LookupTable::SetLUT functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted, malformed file can lead to memory corruption. An attacker can provide a malicious file to exploit this vulnerability...

Astra Linux – Vulnerability in dcmtk

The service class user SCU of OFFIS DCMTK all versions prior to 3.6.7 is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could enable remote code execution...

Astra Linux – Vulnerability in dcmtk

DCMTK through version 3.6.6 does not handle memory deallocation properly. The malloc function allocates heap memory for data parsing, but does not deallocate that memory when there are errors in parsing. Sending specific requests to the dcmqrdb program leads to memory leaks. An attacker can use...

Astra Linux – Vulnerability in dcmtk

DCMTK’s version 3.6.6 does not handle memory release properly. The memory allocated for storing all file information is stored in a global variable called LST, and this memory is not released properly. Making specific requests to the dcmqrdb program can lead to a memory leak. An attacker can use...

Astra Linux – Vulnerability in dcmtk

OFFIS DCMTK’s all versions prior to 3.6.7 has a NULL pointer dereference vulnerability when processing DICOM files, which may lead to a denial-of-service condition...

Astra Linux – Vulnerability in dcmtk

DCMTK through version 3.6.6 does not handle string copying properly. When specific requests are sent to the dcmqrdb program, it queries its database and copies the result, even if the result is null. This can lead to a head-based overflow. An attacker can use this vulnerability to launch a DoS...

Linux Distros Unpatched Vulnerability : CVE-2026-87020

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied...

DEBIAN-CVE-2026-87020

An integer overflow in a specified pitch and buffer-size computation leads to a heap out-of-bounds write when Orthanc DICOM Server decodes an attacker-supplied PNG...