Cloudanix VulnDB

CVE-2024-28130

High · 7.5

CVSS

7.5

EPSS

1.7%

Published

Apr 23, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A bug in software that handles medical scan files lets attackers run their own programs on affected computers simply by sending a bad file.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Remote Code Execution
Component
Library
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

An incorrect type conversion in DVPSSoftcopyVOI_PList::createFromImage allows a malformed file to trigger arbitrary code execution via memory corruption.

Why it matters to the business

Systems processing medical images face risk of remote code execution, enabling full compromise; 132 downstream dependents increase exposure across ecosystems, though not yet in KEV or ransomware campaigns.

How an attack unfolds

An attacker crafts a specially malformed file exploiting the type conversion flaw in DCMTK 3.6.8 and supplies it to a vulnerable application, resulting in arbitrary code execution without authentication.

How to fix it

Upgrade affected packages to the listed fixed versions including sqlite3 (Debian:11): fixed in 3.32.0-1, sqlite3 (Debian:12): fixed in 3.32.0-1, sqlite3 (Debian:13): fixed in 3.32.0-1, sqlite3 (Ubuntu:18.04:LTS): fixed in 3.22.0-1ubuntu0.6, and sqlite3 (Ubuntu:20.04:LTS): fixed in 3.31.1-4ubuntu0.4. Apply patches immediately given the 904 days since publication and stable EPSS trend.

How to confirm the fix worked

Confirm the installed DCMTK version is no longer 3.6.8 and test parsing of known-malformed sample files to verify the type conversion flaw is resolved.

Typical attack path

  1. Craft malformed input file targeting the image processing code path
  2. Deliver the file to a target application using the vulnerable DCMTK library
  3. Trigger file parsing via network or local input
  4. Exploit memory corruption to execute attacker-controlled code

How to detect it

Review application logs for unexpected crashes or errors during image file parsing, inspect process creation events following file ingestion, and search for anomalous memory allocations or code injection artifacts in affected processes.

What your security team should do

  • Prioritize patching all instances of DCMTK to fixed releases within the next 30 days due to code execution potential
  • Scan for and replace any remaining vulnerable versions across the 132 dependent packages
  • Implement file validation and sandboxing for incoming DICOM images as a compensating control
  • Monitor EPSS and threat intelligence for any increase in exploitation activity

The record

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 dcmtk 0 3.6.4-2.1+deb10u1
Debian:11 dcmtk 0 No fix
Debian:11 dcmtk 0 3.6.5-1+deb11u1
Debian:12 dcmtk 0 No fix
Debian:12 dcmtk 0 3.6.7-9~deb12u3
Debian:13 dcmtk 0 3.6.7-14
Mageia:9 dcmtk 0 3.6.7-4.1.mga9
SUSE:Package Hub 15 SP5 dcmtk 0 3.6.8-bp155.3.3.1
Ubuntu:20.04:LTS dcmtk 0 3.6.4-2.1ubuntu0.1
Ubuntu:22.04:LTS dcmtk 0 No fix
Ubuntu:24.04:LTS dcmtk 0 No fix
Ubuntu:24.10 dcmtk 0 No fix
Ubuntu:25.04 dcmtk 0 No fix
Ubuntu:25.10 dcmtk 0 No fix
Ubuntu:Pro:16.04:LTS dcmtk 0 No fix
Ubuntu:Pro:16.04:LTS dcmtk 0 3.6.1~20150924-5ubuntu0.1~esm2
Ubuntu:Pro:18.04:LTS dcmtk 0 No fix
Ubuntu:Pro:18.04:LTS dcmtk 0 3.6.2-3ubuntu0.1~esm2
Ubuntu:Pro:22.04:LTS dcmtk 0 3.6.6-5ubuntu0.1~esm2
Ubuntu:Pro:24.04:LTS dcmtk 0 No fix
Ubuntu:Pro:24.04:LTS dcmtk 0 3.6.7-9.1ubuntu0.1~esm1
openSUSE:Leap 15.5 dcmtk 0 3.6.8-bp155.3.3.1

Related vulnerabilities