CVE-2024-29421

What it actually does

Buffer overflow in DICOM parsing code allows memory corruption and arbitrary code execution when processing a malicious file.

Why it matters to the business

Attackers can gain control of systems running the vulnerable software, leading to potential data theft, ransomware deployment, or service disruption in environments handling medical images.

How an attack unfolds

An attacker crafts a malformed DICOM file that triggers the overflow in the basic.c parsing routine; when the file is opened locally, the overflow overwrites return addresses or function pointers, allowing shellcode execution.

How to fix it

Upgrade to version 0.24.0 or later. If immediate upgrade is not possible, restrict opening of untrusted DICOM files and run the application under least-privilege accounts.

How to confirm the fix worked

Verify the installed binary or package reports version 0.24.0 or higher; test by attempting to process known-good and known-malformed DICOM files in a controlled environment.

Typical attack path

1. Identify or gain access to a system with the vulnerable version installed
2. Prepare a specially crafted DICOM file that overflows the buffer in libs/dicom/basic.c
3. Deliver the file via email, USB, or network share
4. Trick the user or automated process into opening the file with the affected application
5. Execute arbitrary code with the privileges of the running process

How to detect it

Review application logs and system process creation events around the time a suspicious DICOM file was accessed; look for crashes or unexpected child processes spawned by the xmedcon binary.

What your security team should do

• Prioritize upgrade to the fixed version across all instances within the next patching cycle
• Add the application to the inventory of medical imaging tools and enforce software restriction policies
• Monitor for new exploit code or public proof-of-concept releases given the local attack vector