CVE-2025-53618 - CVE House
Back to Database
Status published High CVE-2025-53618

An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of...

Vulnerability Description

An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to an information leak. An attacker can provide a malicious file to trigger this vulnerability.The function `grayscale_convert` is called based of the value of the malicious DICOM file specifying the intended interpretation of the image pixel data

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53618

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Discovered by Emmanuel Tacheau of Cisco Talos.

References

More from Grassroot DICOM

View All →
CVE-2025-53619
An out-of-bounds read vulnerability exists in the JPEGBITSCodec::InternalCode functionality of...
High 7.4
CVE-2025-52582
An out-of-bounds read vulnerability exists in the Overlay::GrabOverlayFromPixelData functionality of...
High 7.4
CVE-2025-48429
An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of...
High 7.4
CVE-2024-25569
An out-of-bounds read vulnerability exists in the RAWCodec::DecodeBytes functionality of...
Medium 6.5
CVE-2024-22391
A heap-based buffer overflow vulnerability exists in the LookupTable::SetLUT functionality...
High 7.7

Affected Vendor

Grassroot DICOM

View all reports →

Affected Software

Grassroot DICOM
Vulnerable Versions:
3.024

Timeline

Official Publish: December 16th, 2025
Last Modified: December 17th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-119

MITRE ATT&CK TTPs

T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1203 Exploitation for Client Execution
Execution
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control