CVE-2025-9732

Executive Summary

CVE-2025-9732 is a memory corruption vulnerability identified in the DCMTK (DICOM Toolkit) library, specifically affecting versions up to and including 3.6.9. The flaw resides in the dcmimage/include/dcmtk/dcmimage/diybrpxt.h file, which is part of the dcm2img component. This vulnerability can be triggered locally, requiring an attacker to have access to the system or to trick a user into processing a malicious DICOM file. Successful exploitation could lead to memory corruption, potentially resulting in a denial of service or arbitrary code execution. The vendor has released a patch (commit 7ad81d69b), and it is strongly recommended to apply it.

Supply Chain & Package Security

This vulnerability affects the DCMTK library, which is a widely used open-source toolkit for handling DICOM (Digital Imaging and Communications in Medicine) data. DCMTK is often integrated into medical imaging software, PACS (Picture Archiving and Communication Systems), and research tools. Organizations using DCMTK in their software supply chain should verify their dependency versions and apply the patch to prevent exploitation.

CVSS Breakdown & Threat Level

The CVSS score for this vulnerability is currently listed as 0.0, indicating that a full CVSS vector has not been assigned. However, based on the description and the nature of the vulnerability (memory corruption), the potential impact is high. The attack vector is local, meaning an attacker must have local access to the system or convince a user to open a malicious file. The complexity is likely low, as the vulnerability can be triggered by processing a crafted DICOM image. The confidentiality, integrity, and availability impacts could be high if arbitrary code execution is achieved.

Deep Dive & Mechanics

The vulnerability is located in the diybrpxt.h header file within the dcmimage library. This file is responsible for handling the conversion of DICOM images to other formats (e.g., JPEG, BMP) via the dcm2img tool. The exact nature of the memory corruption is not publicly detailed, but it likely involves improper bounds checking or buffer overflow when processing malformed DICOM pixel data. An attacker can craft a DICOM file with specially crafted pixel data that, when processed by dcm2img, causes the library to write beyond allocated memory, leading to corruption.

The attack requires local access, meaning the attacker must either have a user account on the target system or trick a user into running dcm2img on a malicious file. This could be achieved through social engineering, such as sending a malicious DICOM file via email or hosting it on a website.

Vulnerable vs. Patched Code

The patch (commit 7ad81d69b) addresses the memory corruption issue. While the exact code changes are not publicly available, the patch likely introduces bounds checking or input validation to prevent the overflow. Below is a hypothetical example of the vulnerable and patched code.

Vulnerable Code (diybrpxt.h, version <= 3.6.9):

// Hypothetical vulnerable code
void processPixelData(const unsigned char* input, size_t inputSize) {
    unsigned char buffer[1024];
    // No bounds checking
    memcpy(buffer, input, inputSize); // Potential overflow
}

Patched Code (after commit 7ad81d69b):

// Hypothetical patched code
void processPixelData(const unsigned char* input, size_t inputSize) {
    unsigned char buffer[1024];
    if (inputSize > sizeof(buffer)) {
        // Handle error
        return;
    }
    memcpy(buffer, input, inputSize);
}

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would need to craft a malicious DICOM file that triggers the memory corruption. Since no public exploit code is available, the following steps outline a general approach:

1. Craft a Malicious DICOM File: Use a DICOM library or hex editor to modify pixel data in a DICOM file to cause an overflow. For example, set the pixel data length to a value larger than the expected buffer size.
2. Deliver the File: Send the file to the target via email, USB drive, or other means, and convince the user to run dcm2img on it.
3. Trigger the Vulnerability: Execute dcm2img -i malicious.dcm -o output.bmp to process the file.
4. Achieve Code Execution: If the memory corruption is exploitable, the attacker may be able to overwrite function pointers or return addresses to execute arbitrary code.

Lab Setup:

• Target: A system running DCMTK version 3.6.9 or earlier.
• Attacker: A system with DCMTK installed to craft the malicious file.
• Tools: Python with pydicom library, hex editor, or custom script to modify DICOM pixel data.

Example Python script to craft a malicious DICOM file:

import pydicom
from pydicom.dataset import Dataset, FileDataset
import struct

# Create a basic DICOM dataset
ds = Dataset()
ds.PatientName = "Test"
ds.PatientID = "12345"
ds.StudyInstanceUID = "1.2.3.4.5.6.7.8.9"
ds.SeriesInstanceUID = "1.2.3.4.5.6.7.8.9.1"
ds.SOPInstanceUID = "1.2.3.4.5.6.7.8.9.2"
ds.Modality = "CT"
ds.Rows = 100
ds.Columns = 100
ds.BitsAllocated = 16
ds.PixelRepresentation = 0
ds.PixelData = b"A" * 2000  # Overflow pixel data

# Save to file
ds.save_as("malicious.dcm")

Blue Team

To detect and defend against this vulnerability:

1. Monitor for Suspicious DICOM Files: Use file integrity monitoring (FIM) to detect unusual DICOM files being processed.
2. User Awareness: Train users not to open DICOM files from untrusted sources.
3. Application Whitelisting: Restrict execution of dcm2img to authorized users and scripts.
4. Patch Management: Apply the patch (commit 7ad81d69b) to all affected systems.
5. Network Segmentation: Limit access to systems running DCMTK to reduce the attack surface.

Indicators of Compromise (IOCs)

• File Hashes: Malicious DICOM files may have unusual pixel data lengths or patterns.
• Process Anomalies: Unexpected crashes or memory errors in dcm2img or other DCMTK-based applications.
• Network Traffic: Unusual outbound connections from systems processing DICOM files (if code execution is achieved).
• Log Entries: Application logs showing errors related to memory allocation or buffer overflows.

Detection Engineering

YARA Rule

rule CVE_2025_9732_DCMTK_Memory_Corruption {
    meta:
        description = "Detects malicious DICOM files targeting CVE-2025-9732"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9732"
    strings:
        $dicom_header = "DICM"
        $large_pixel_data = { (00 10 00 30) } // PixelData tag (7FE0,0010)
    condition:
        $dicom_header at 128 and #large_pixel_data > 0 and filesize > 1000000
}

Sigma Rule

title: DCMTK Memory Corruption Exploitation Attempt
id: 7ad81d69b-1234-5678-9abc-def012345678
status: experimental
description: Detects attempts to exploit CVE-2025-9732 via dcm2img
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\dcm2img.exe'
        CommandLine|contains: '-i'
    condition: selection
falsepositives:
    - Legitimate use of dcm2img by authorized personnel
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-9732 DCMTK Memory Corruption Attempt"; flow:to_server,established; content:"DICM"; offset:128; depth:4; content:"|7F E0 00 10|"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply the Patch: Immediately apply the patch identified by commit 7ad81d69b to all affected DCMTK installations.
2. Update to Latest Version: Upgrade to DCMTK version 3.6.9 or later, ensuring the patch is included.
3. Restrict Access: Limit local access to systems running DCMTK to trusted users only.
4. Input Validation: Implement additional input validation for DICOM files before processing.
5. Monitor Logs: Enable logging for DCMTK applications and monitor for unusual errors or crashes.
6. User Training: Educate users about the risks of opening DICOM files from untrusted sources.

Report generated by Valters IT DevSecOps & CTI Expert System