A critical out-of-bounds read vulnerability in Grassroot DICOM 3.024 exposes sensitive heap memory to potential unauthorized access via malicious file processing.

This is an out-of-bounds read vulnerability (CWE-119) occurring within the RLECodec::DecodeByStreams functionality. An unauthenticated attacker can trigger this flaw by supplying a specially crafted DICOM file to the application.

The vulnerability carries a CVSS score of 7.4, indicating high severity. Successful exploitation allows an attacker to leak heap data, which may contain sensitive information, cryptographic keys, or session data. This poses a significant risk to data confidentiality and could facilitate further exploitation of the host environment.

Immediate Action: Since no official patch version is currently identified, users should restrict access to the affected software and avoid processing untrusted DICOM files until vendor updates are released.

Proactive Monitoring: Monitor system logs for unusual application crashes or memory access errors that may indicate an attempt to trigger this out-of-bounds condition.

Compensating Controls: Implement file integrity monitoring and utilize security scanning tools to inspect incoming DICOM files for malformed headers or RLE compression irregularities before they are processed by the application.

Public Exploit Available: No.

Given the potential for heap data leakage, this vulnerability poses a notable risk to environments handling sensitive imaging data. Organizations should prioritize isolating the affected software from external inputs and monitor vendor channels for the release of an official security patch. Immediate action is required to minimize exposure while awaiting a permanent remediation.