CVE-2025-11266 Grassroots DICOM (GDCM) Out-of-bounds Write
Attackers can cause a denial of service by tricking users into opening a malicious DICOM file, affecting applications using the GDCM library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-11266?
CVE-2025-11266 is a medium-severity memory corruption vulnerability in Grassroots DICOM (GDCM), published on 12 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
An out-of-bounds write vulnerability exists in the Grassroots DICOM library (GDCM). The issue is triggered during parsing of a malformed DICOM file containing encapsulated PixelData fragments (compressed image data stored as multiple fragments). This vulnerability leads to a segmentation fault caused by an out-of-bounds memory access due to unsigned integer underflow in buffer indexing. It is exploitable via file input, simply opening a crafted malicious DICOM file is sufficient to trigger the crash, resulting in a denial-of-service condition.
Weakness: CWE-787
Which versions are affected by CVE-2025-11266?
How do I fix CVE-2025-11266?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2025-11266 being exploited?
There is no known exploitation of CVE-2025-11266 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2025-11266, GHSA-7qcj-ww2g-7w6j, UBUNTU-CVE-2025-11266.