Several Vulnerabilities in Grassroots DICOM (GDCM) Software

23.09.2026 – Advisories – SYSS-2026-067/-068/-069/-070/-071

Security Advisories by Senior Expert IT Security Consultant Matthias Deeg

As part of a research project on "AI-assisted vulnerability analysis," SySS IT security expert Matthias Deeg, working with AI agents, discovered several security vulnerabilities in the open-source software Grassroots DICOM (GDCM).

The five vulnerabilities consist of two stack-based buffer overflow vulnerabilities, two integer overflow vulnerabilities, and one format string vulnerability, all of which affect different GDCM components. Depending on the application context, these vulnerabilities can be exploited by attackers to launch denial-of-service attacks, gain access to sensitive data, and, under certain conditions, execute program code.

For the vulnerability analysis by AI agents in this R&D project, Qwen's open-weight AI model Qwen3.6-27B, or rather its modified variant Qwopus3.6-27B-v2, was used, which was deployed on a local AI system at SySS.

You will find detailed information about these security issues in our Security Advisories:

You will find further information about our Responsible Disclosure Policy concerning the publishing process of SySS Security Advisories here.