CVE-2024-22373

What it actually does

The vulnerability permits an out-of-bounds write during JPEG2000 stream decoding in the DICOM library, resulting in a heap buffer overflow that can corrupt memory and enable arbitrary code execution.

Why it matters to the business

Successful exploitation could allow attackers to compromise systems handling medical imaging data, risking unauthorized access to sensitive patient information, disruption of clinical workflows, and potential regulatory penalties in healthcare settings.

How an attack unfolds

An attacker creates a malformed DICOM file embedding malicious JPEG2000 data that triggers the decoder flaw; when the file is opened or imported by an application using the vulnerable library, the overflow occurs and attacker-controlled code runs in the context of the processing application.

How to fix it

Upgrade the Grassroot DICOM library to the latest patched release that corrects the JPEG2000Codec decoding logic. Where upgrades are delayed, isolate DICOM processing to trusted sources only and apply strict file-type validation before decoding.

How to confirm the fix worked

Reprocess a corpus of known-good and previously crashing DICOM samples under the updated library, confirm absence of crashes or memory errors with address sanitizer tooling, and verify vendor release notes reference resolution of the JPEG2000 out-of-bounds write.

Typical attack path

1. Craft a specially malformed DICOM file containing malicious JPEG2000 streams
2. Deliver the file to a target via email, file share, or network transfer
3. Induce the victim application or automated workflow to process the DICOM file
4. Trigger the heap overflow during DecodeByStreamsCommon execution
5. Leverage memory corruption to achieve code execution or denial of service

How to detect it

Review application and system logs for crashes or errors during DICOM import operations, monitor for unexpected child processes spawned by DICOM viewers, and inspect memory dumps from decoder failures for signs of overflow patterns.

What your security team should do

• Prioritize patching all instances of the affected DICOM library within the next maintenance window
• Block or sandbox processing of DICOM files from untrusted external sources
• Add runtime memory protections such as ASLR and heap canaries where feasible
• Subscribe to vendor and NVD alerts for subsequent Grassroot DICOM updates