CVE-2024-22391

What it actually does

Heap-based buffer overflow in LookupTable::SetLUT triggered by a malformed file, resulting in memory corruption.

Why it matters to the business

Medical imaging and DICOM processing systems may experience crashes, data integrity loss, or remote code execution, disrupting clinical workflows and risking patient data exposure.

How an attack unfolds

An attacker crafts a specially malformed DICOM file and supplies it to the vulnerable software; when LookupTable::SetLUT processes the file, the overflow corrupts memory and enables further attacker control.

How to fix it

Upgrade Grassroot DICOM to the latest patched release that resolves the LookupTable::SetLUT issue; if no update is available, isolate affected systems and apply input sanitization where feasible.

How to confirm the fix worked

Verify installed version is newer than 3.0.23, test file ingestion with known-good and malformed samples in a lab environment, and confirm absence of crashes or memory errors during processing.

Typical attack path

1. Craft a malformed DICOM file targeting LookupTable::SetLUT
2. Deliver the file to a vulnerable application instance
3. Trigger file parsing and LUT processing
4. Exploit the resulting heap overflow for memory corruption or code execution

How to detect it

Inspect application logs for crashes or errors during DICOM file parsing, review memory dumps for heap corruption patterns around LUT handling, and correlate file ingestion events with unexpected process behavior.

What your security team should do

• Apply vendor updates immediately given the two-year disclosure window
• Restrict untrusted DICOM file ingestion to hardened processing nodes
• Monitor application logs and memory usage for anomalous behavior during file handling
• Review downstream dependents that embed the library for exposure