CVE-2024-52333
Published: 13 January 2025
Description
An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.
Security Summary
CVE-2024-52333 is an improper array index validation vulnerability in the determineMinMax functionality of OFFIS DCMTK version 3.6.8. The flaw allows a specially crafted DICOM file to trigger an out-of-bounds write, classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). It received a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and was published on January 13, 2025.
A local attacker with low complexity and no privileges or user interaction required can exploit this vulnerability by providing a malicious DICOM file to a vulnerable DCMTK instance. Successful exploitation leads to high confidentiality, integrity, and availability impacts through the out-of-bounds write.
Mitigation is addressed in a DCMTK git commit (03e851b0586d05057c3268988e180ffb426b2e03), with detailed analysis in the Talos Intelligence report TALOS-2024-2121. Debian LTS users should refer to the announcement at lists.debian.org/debian-lts-announce/2025/01/msg00032.html for patched packages.
Details
- CWE(s)