A critical out-of-bounds read vulnerability in Grassroot DICOM 3.024 poses a significant risk of information disclosure through maliciously crafted image files.

This vulnerability resides in the JPEGBITSCodec::InternalCode function, where improper bounds checking during the processing of DICOM pixel data allows for an out-of-bounds read. The issue is triggered when the application processes a malicious file, leading to the execution of the grayscale_convert function based on tainted input.

Successful exploitation of this memory safety flaw could result in the disclosure of sensitive information from the application memory. Given the CVSS score of 7.4, this vulnerability represents a high risk to data confidentiality and integrity, particularly in clinical or diagnostic environments where DICOM data is processed and stored.

Immediate Action: Users should restrict the processing of untrusted DICOM files and verify the integrity of incoming data until a vendor-supplied security patch is released.

Proactive Monitoring: Security teams should monitor system logs for application crashes or abnormal memory usage patterns associated with the DICOM processing engine.

Compensating Controls: Implement strict file validation and sandboxing for all DICOM processing workflows to isolate potentially malicious files from core system memory.

Public Exploit Available: No — no confirmed public exploit exists for this vulnerability.

While this vulnerability requires a specific file-based attack vector, its potential for information disclosure in a medical imaging context is severe. Organizations currently utilizing Grassroot DICOM 3.024 must prioritize the implementation of strict input validation and monitor vendor communication channels for the release of an official patch to remediate this memory safety issue.