CVE-2025-53619 is a High severity out-of-bounds read (CVSS 7.4) in Grassroots DICOM 3.024, the open source medical imaging library. A crafted DICOM file can trigger it and leak information. The record names no fixed version, so check the Talos report before you rely on any update.
What's affected
The record lists Grassroots DICOM version 3.024 as affected, and the weakness sits in the JPEGBITSCodec::InternalCode functionality.
The record does not give a fixed version. The only reference is the Talos report TALOS-2025-2210, so read it and the project release notes before you decide which build is safe. Anything that links the library statically, or bundles it inside an imaging tool, inherits the issue too.
The attack vector in the record is local, with high attack complexity and no privileges needed. In practice that means a file has to reach a program that opens it, for example through an upload, a shared folder or an email attachment.
How to check if you're exposed
Find out where the library lives in your estate. On Linux, ask the package manager, and look for bundled copies in application folders:
dpkg -l | grep -i gdcm
rpm -qa | grep -i gdcm
find / -name "libgdcm*" 2>/dev/null
If you build software from source or use Python wheels or vendored directories, check the build manifests and software bill of materials instead. Then list which services open DICOM files from untrusted sources, such as a viewer, a converter or an import job. Those are the places where the flaw can be reached.
What to do now
- Inventory every product that includes Grassroots DICOM, including copies vendored inside imaging software.
- Read the Talos report and the project release notes to confirm which build contains the fix, then upgrade where one exists.
- Until then, do not open DICOM files from untrusted senders in tools that use the library. Quarantine incoming files for review.
- Run image parsing services as a low privilege account, in a container or a sandbox, with no access to patient records they do not need.
- Add the library to your continuous monitoring so a later fix or a new record is caught without a manual search.
Why it matters
The root weakness is CWE-125 (out-of-bounds read) within CWE-119 (improper restriction of operations within a memory buffer). The decoder reads past the end of a buffer when it handles a pixel data setting given by the file. The record explains that a function called null_convert is selected from a value in the file that states how the pixel data should be interpreted, so the file itself steers the code path.
Medical imaging libraries parse complex binary formats from many sources, and parsers are a rich source of memory errors. An information leak may look mild, but memory contents can include other data held by the same process. That is why the file source matters more than the score.
The record is not in the CISA Known Exploited Vulnerabilities catalogue.
Quick check
Does the record say this is exploited in the wild?
No. The record is not flagged in the CISA Known Exploited Vulnerabilities catalogue, and nothing in it claims active exploitation.
Why is the attack vector local if files come from outside?
Because the attacker needs a file to be opened by a program on the host. The route there, such as an upload or an email, depends on how your workflow handles files.
Sources
Last reviewed: 18 October 2026.
