A critical out-of-bounds read vulnerability in Grassroot DICOM 3.024 could allow an attacker to trigger an information leak via malicious image processing.

This vulnerability involves an improper restriction of operations within the bounds of a memory buffer (CWE-119). An unauthenticated attacker can trigger the flaw by providing a malicious DICOM file that causes the null_convert function to process pixel data incorrectly, resulting in an information leak.

The exploitation of this vulnerability poses a significant risk to data confidentiality and integrity, as it facilitates unauthorized memory access. Given the CVSS score of 7.4, this issue is considered High severity, as it could allow an attacker to bypass security controls or crash critical medical imaging services, leading to potential operational disruption or the exposure of sensitive patient data.

Immediate Action: Contact the vendor immediately to determine the availability of a security patch for version 3.024, as no official fix is currently confirmed.

Proactive Monitoring: Monitor system logs for abnormal application crashes or unauthorized attempts to parse malformed DICOM files within the imaging environment.

Compensating Controls: Restrict access to the DICOM processing service to only trusted, authenticated users and implement strict input validation on all incoming DICOM files to identify and reject malformed data.

Public Exploit Available: Unknown.

Organizations utilizing Grassroot DICOM 3.024 should treat this vulnerability with high priority. Since a patch is not yet confirmed, administrators must implement strict input validation and access controls to mitigate the risk of an attacker successfully delivering a malicious DICOM file to the vulnerable JPEGBITSCodec functionality.