CVE-2025-25475

Executive Summary

CVE-2025-25475 is a NULL pointer dereference vulnerability discovered in the DCMTK library, version 3.6.9+ DEV. The flaw resides in the /libsrc/dcrleccd.cc component, which is responsible for decoding RLE (Run-Length Encoding) compressed DICOM image data. An attacker can trigger a Denial of Service (DoS) by crafting a malicious DICOM file that, when processed by an application using the vulnerable library, causes the application to crash due to a NULL pointer dereference.

This vulnerability is classified as a local attack vector with low complexity, requiring user interaction (opening a malicious file). The primary impact is on availability, with no direct impact on confidentiality or integrity. The EPSS score is 0.0%, indicating a low probability of exploitation in the wild at this time. No public proof-of-concept (PoC) code or exploit is currently available.

Supply Chain & Package Security

This vulnerability affects the DCMTK library, which is a widely used open-source library for handling DICOM (Digital Imaging and Communications in Medicine) data. DCMTK is not distributed via typical package managers like NPM, PyPI, Go, or Ruby, but is often compiled from source or included as a dependency in medical imaging software. The supply chain risk is moderate, as the vulnerability exists in a development version and no official patch has been released. Organizations using DCMTK in production should monitor for updates and consider temporary mitigations.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score: 5.5)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
• Attack Vector (AV): Local (L) – The attacker must have local access to the system or be able to deliver a malicious file to the user.
• Attack Complexity (AC): Low (L) – No special conditions are required to exploit the vulnerability.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): Required (R) – The victim must open the malicious DICOM file.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The application crashes, causing a denial of service.
• Threat Level: Medium – While the CVSS base score is 5.5 (Medium), the lack of a patch and the potential for use in targeted attacks against medical imaging systems elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference in the RLE decoding routine of DCMTK. The function responsible for decoding RLE-compressed DICOM data does not properly validate the input data before dereferencing a pointer. When a specially crafted DICOM file is processed, the pointer is set to NULL, and the subsequent dereference causes a segmentation fault, crashing the application.

The vulnerable code is located in /libsrc/dcrleccd.cc. The exact line is not publicly disclosed, but the issue likely occurs when the decoder attempts to access a data structure that was not properly initialized due to malformed input. This is a common class of vulnerability in parsers that handle complex binary formats like DICOM.

The attack surface is any application that uses DCMTK to process DICOM files, including PACS (Picture Archiving and Communication Systems) viewers, medical imaging workstations, and DICOM servers. The attack is triggered by user interaction, such as opening an email attachment or downloading a file from a compromised website.

Vulnerable vs. Patched Code

Since no official patch has been released, a direct code comparison is not possible. However, the vulnerable code pattern can be described:

Vulnerable Code (Conceptual):

// In dcrleccd.cc
void decodeRLE(SomeStruct* data) {
    // data is not checked for NULL
    int value = data->someField; // NULL pointer dereference if data is NULL
    // ... rest of decoding
}

Patched Code (Conceptual):

// In dcrleccd.cc
void decodeRLE(SomeStruct* data) {
    if (data == NULL) {
        // Handle error gracefully
        return;
    }
    int value = data->someField;
    // ... rest of decoding
}

The fix would involve adding a NULL check before dereferencing any pointer that could be set to NULL by malformed input. This is a standard defensive programming practice.

Exploitation & Lab Setup

Red Team (Exploitation)

Objective: Cause a denial of service in a DICOM viewer or server by sending a crafted DICOM file.

Prerequisites:

• A target system running a vulnerable version of DCMTK (v3.6.9+ DEV).
• Ability to deliver a malicious DICOM file to the target (e.g., via email, web download, or network share).

Steps:

1. Craft the Malicious DICOM File: Use a hex editor or a custom script to create a DICOM file with a malformed RLE segment. The exact structure is not publicly known, but the goal is to cause the RLE decoder to dereference a NULL pointer.
2. Deliver the File: Send the file to the target user via email or upload it to a website they are likely to visit.
3. Trigger the Vulnerability: The user opens the file in a DICOM viewer (e.g., DCMTK's dcm2pnm or a PACS workstation). The application crashes.

Example (Conceptual Python script to generate a malformed DICOM file):

import struct

def create_malicious_dicom():
    # This is a simplified example; actual DICOM structure is more complex
    # The goal is to create a file that triggers the NULL pointer dereference
    with open('malicious.dcm', 'wb') as f:
        # DICOM preamble (128 bytes)
        f.write(b'\x00' * 128)
        # DICOM prefix "DICM"
        f.write(b'DICM')
        # Meta Information Group Length (0002,0000)
        # ... (omitted for brevity)
        # Pixel Data (7FE0,0010) with RLE compression
        # The RLE segment is crafted to cause a NULL pointer dereference
        # This is a placeholder; actual exploitation requires deep knowledge of DICOM
        f.write(b'\x00' * 100)
    print("Malicious DICOM file created: malicious.dcm")

create_malicious_dicom()

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Defense)

Detection:

• Monitor for crashes in applications that use DCMTK (e.g., dcm2pnm, dcmqrscp).
• Use file integrity monitoring to detect the presence of suspicious DICOM files.
• Implement network segmentation to limit exposure of DICOM servers.

Mitigation:

• Immediate: Disable RLE decoding if not needed, or use a different DICOM library.
• Long-term: Apply the official patch when it becomes available. In the meantime, consider using a web application firewall (WAF) or intrusion prevention system (IPS) to filter malformed DICOM files.

Indicators of Compromise (IOCs)

• File Hashes: No specific hashes are available as no PoC has been published.
• Network Indicators: DICOM traffic (port 104, 11112) containing malformed RLE segments.
• System Indicators: Application crash logs showing a segmentation fault in dcrleccd.cc.
• YARA Rule (see Detection Engineering): Detects the specific byte pattern that triggers the vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_25475_DCMTK_NULL_PTR {
    meta:
        description = "Detects DICOM files exploiting CVE-2025-25475 NULL pointer dereference"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25475"
    strings:
        $rle_magic = { 52 4C 45 } // "RLE" in ASCII
        $null_trigger = { 00 00 00 00 } // Potential NULL pointer trigger pattern
    condition:
        $rle_magic and #null_trigger > 5
}

Sigma Rule

title: CVE-2025-25475 DCMTK NULL Pointer Dereference
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects crashes in DCMTK applications due to NULL pointer dereference
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: dcmtk
detection:
    selection:
        EventID: 1000  # Application Error (Windows)
        Application: "dcm2pnm.exe" or "dcmqrscp.exe"
        ExceptionCode: 0xc0000005  # Access Violation
        FaultingModule: "dcrleccd.dll" or "libdcmtk.so"
    condition: selection
falsepositives:
    - Unknown
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 104 (msg:"CVE-2025-25475 DCMTK RLE NULL Pointer Dereference Attempt"; flow:to_server,established; content:"|52 4C 45|"; distance:0; within:3; content:"|00 00 00 00|"; distance:0; within:4; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable RLE decoding in DCMTK if not required.
   • Use a different DICOM library (e.g., GDCM) as a temporary workaround.
   • Implement strict input validation for DICOM files.

2. Long-term Actions:

   • Monitor the DCMTK project for an official patch.
   • Apply the patch as soon as it is released.
   • Update all applications that use DCMTK to the patched version.

3. Compensating Controls:

   • Use application whitelisting to prevent unauthorized DICOM viewers.
   • Deploy an IPS/IDS with the Suricata rule provided.
   • Educate users not to open DICOM files from untrusted sources.

Valters IT