CVE-2025-48429
An out-of-bounds read vulnerability exists in the RLECodec::DecodeBySt ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data. An attacker can provide a malicious file to trigger this vulnerability.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | gdcm | 3.0.8-2+deb11u1 |
| debian 12 | gdcm | no fix listed |
| debian 13 | gdcm | no fix listed |
| debian 14 | gdcm | 3.0.24-11 |
| echo | gdcm | no fix listed |
| rapidfort debian 12 | gdcm | 0:3.0.24-11 |
| rapidfort debian 13 | gdcm | 0:3.0.24-11 |
| rapidfort ubuntu 20.04 | gdcm | no fix listed |
| rapidfort ubuntu 22.04 | gdcm | no fix listed |
| rapidfort ubuntu 24.04 | gdcm | no fix listed |
| ubuntu 18.04-ESM | gdcm | no fix listed |
| ubuntu 20.04-ESM | gdcm | no fix listed |
Show all 16 entries from 16 sources
| Source | Package | Fixed in |
|---|---|---|
| debian 11 | gdcm | 3.0.8-2+deb11u1 |
| debian 12 | gdcm | no fix listed |
| debian 13 | gdcm | no fix listed |
| debian 14 | gdcm | 3.0.24-11 |
| echo | gdcm | no fix listed |
| rapidfort debian 12 | gdcm | 0:3.0.24-11 |
| rapidfort debian 13 | gdcm | 0:3.0.24-11 |
| rapidfort ubuntu 20.04 | gdcm | no fix listed |
| rapidfort ubuntu 22.04 | gdcm | no fix listed |
| rapidfort ubuntu 24.04 | gdcm | no fix listed |
| ubuntu 18.04-ESM | gdcm | no fix listed |
| ubuntu 20.04-ESM | gdcm | no fix listed |
| ubuntu 22.04 | gdcm | no fix listed |
| ubuntu 24.04 | gdcm | no fix listed |
| ubuntu 26.04 | gdcm | no fix listed |
| ubuntu 26.10 | gdcm | no fix listed |