A high-severity out-of-bounds read vulnerability in Grassroot DICOM 3.024 could allow an attacker to trigger an information leak through a malicious file.

This vulnerability involves an improper restriction of operations within the bounds of a memory buffer (CWE-119) in the Overlay::GrabOverlayFromPixelData function. An unauthenticated attacker can exploit this flaw by providing a specially crafted DICOM file to the application.

The exploitation of this vulnerability can result in the unauthorized disclosure of sensitive memory contents, potentially leading to an information leak. With a CVSS score of 7.4, this issue represents a significant risk to data confidentiality, as attackers could extract sensitive information processed by the DICOM software.

Immediate Action: Since a specific patch version is currently not identified, users should restrict the processing of untrusted DICOM files and monitor vendor channels for the release of a security update.

Proactive Monitoring: Security teams should monitor system logs for crashes or unusual memory access errors occurring during the ingestion or processing of DICOM files.

Compensating Controls: Implement file validation and sandboxing techniques to isolate the DICOM processing environment, which may prevent malicious files from interacting with sensitive host memory.

Public Exploit Available: Unknown.

Given the potential for information disclosure, administrators should treat this vulnerability with high priority. Monitor the Grassroot security advisories closely for the availability of a patch and ensure that any DICOM data ingestion pipelines are configured to reject or sanitize non-validated files until a formal fix is applied.