CVE-2025-2357

Executive Summary

CVE-2025-2357 is a critical memory corruption vulnerability in the DCMTK library, version 3.6.9, specifically within the dcmjpls JPEG-LS decoder component. The vulnerability allows a remote attacker to trigger memory corruption by sending a specially crafted JPEG-LS image. This can lead to arbitrary code execution, denial of service, or information disclosure. The exploit has been publicly disclosed, and a patch (commit 3239a7915) is available. The CVSS score is 0.0 due to incomplete NVD data, but based on the nature of the vulnerability, it is assessed as critical.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0, the vulnerability is classified as critical based on the description and public exploit. A realistic CVSS vector would be:

• Attack Vector (AV): Network (N) – The attack can be initiated remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Potential for full data access.
• Integrity (I): High (H) – Potential for full data modification.
• Availability (A): High (H) – Potential for full system denial of service.

Threat Level: Critical. The vulnerability is remotely exploitable with low complexity and no authentication, making it a high-priority target for attackers.

Deep Dive & Mechanics

The vulnerability resides in the dcmjpls module, which implements the JPEG-LS (Lossless JPEG) codec. JPEG-LS is a standard for lossless/near-lossless compression of medical images, commonly used in DICOM files. The DCMTK library is widely used in medical imaging software.

The specific flaw is a memory corruption issue triggered during the decoding of a malicious JPEG-LS image. The decoder likely fails to properly validate the size or structure of the compressed data, leading to a buffer overflow or out-of-bounds write. This can corrupt adjacent memory, potentially allowing an attacker to overwrite function pointers or other critical data structures.

The attack vector is remote: an attacker can send a crafted DICOM file containing a malicious JPEG-LS image to a service using DCMTK. When the service attempts to decode the image, the vulnerability is triggered.

Vulnerable vs. Patched Code

The patch (commit 3239a7915) addresses the memory corruption by adding proper bounds checking and input validation in the JPEG-LS decoder. The exact code changes are not publicly detailed, but the fix likely involves:

• Validating the size of the compressed data buffer before reading.
• Ensuring that decoded pixel data does not exceed the allocated buffer.
• Adding checks for integer overflows in calculations.

Vulnerable Code (Conceptual):

// Vulnerable: No bounds check on compressed data size
void decode_jpegls(const uint8_t *compressed, size_t compressed_size, uint8_t *output, size_t output_size) {
    // ... decode logic that reads from compressed without checking size
    memcpy(output, decoded_data, decoded_size); // Potential overflow
}

Patched Code (Conceptual):

// Patched: Added bounds checking
void decode_jpegls(const uint8_t *compressed, size_t compressed_size, uint8_t *output, size_t output_size) {
    if (compressed_size > MAX_COMPRESSED_SIZE) {
        // Error handling
        return;
    }
    // ... decode logic with proper size checks
    if (decoded_size > output_size) {
        // Error handling
        return;
    }
    memcpy(output, decoded_data, decoded_size);
}

Exploitation & Lab Setup

Red Team

Exploit Code (Conceptual):

import socket

# Craft a malicious JPEG-LS image that triggers the overflow
# This is a simplified example; actual exploit would require reverse engineering
malicious_jpegls = b"\xff\xf7" + b"A" * 10000  # JPEG-LS marker with oversized data

# Wrap in a DICOM file
dicom_file = b"DICM" + malicious_jpegls

# Send to target service
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect(("target_ip", 11112))  # DICOM default port
sock.send(dicom_file)
sock.close()

Lab Setup:

1. Install DCMTK 3.6.9 on a vulnerable system.
2. Set up a DICOM listener (e.g., dcmqrscp or a custom application).
3. Use the exploit script to send the malicious DICOM file.
4. Monitor for crashes or memory corruption.

Blue Team

Detection:

• Monitor for unusual DICOM files with oversized JPEG-LS segments.
• Use network intrusion detection to flag DICOM traffic with anomalous payloads.
• Enable memory corruption detection (e.g., AddressSanitizer) in development environments.

Mitigation:

• Apply the patch (commit 3239a7915) immediately.
• If patching is not possible, disable JPEG-LS decoding or use a different library.
• Implement input validation and sandboxing for DICOM processing.

Indicators of Compromise (IOCs)

• Network: DICOM traffic (port 11112) containing JPEG-LS images with unusually large compressed data segments.
• File: DICOM files with malformed JPEG-LS markers (e.g., \xff\xf7 followed by excessive data).
• System: Memory corruption errors, crashes in dcmjpls module, or unexpected behavior in DICOM processing applications.
• Logs: Application logs showing "Segmentation fault" or "Buffer overflow" in the DCMTK library.

Detection Engineering

YARA Rule

rule CVE_2025_2357_DCMTK_JPEGLS {
    meta:
        description = "Detects malicious DICOM files exploiting CVE-2025-2357"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2357"
    strings:
        $dicom_magic = "DICM"
        $jpegls_marker = { ff f7 }
        $large_data = /[\x00-\xff]{1000,}/  // Large data segment
    condition:
        $dicom_magic at 128 and $jpegls_marker and #large_data > 1
}

Sigma Rule

title: CVE-2025-2357 DCMTK JPEG-LS Memory Corruption
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects network traffic or file events related to CVE-2025-2357
author: Valters IT
date: 2025-04-10
logsource:
    category: network
    product: suricata
detection:
    selection:
        - payload: "DICM"
        - payload: "\\xff\\xf7"
    condition: selection
falsepositives:
    - Legitimate large JPEG-LS images
level: high

Suricata Rule

alert tcp any any -> any 11112 (msg:"CVE-2025-2357 DCMTK JPEG-LS Exploit"; flow:to_server,established; content:"DICM"; offset:128; depth:4; content:"|ff f7|"; within:1000; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply the patch (commit 3239a7915) from the DCMTK repository.
2. Short-term: If patching is delayed, disable JPEG-LS decoding in DCMTK applications or use a different library.
3. Long-term: Implement input validation and fuzz testing for all image decoders in DCMTK.
4. Network: Use network segmentation and firewalls to restrict access to DICOM services.
5. Monitoring: Deploy the provided detection rules to identify exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert