CVE-2024-47796

What it actually does

Improper array index validation in the nowindow functionality leads to an out-of-bounds write when processing a specially crafted DICOM file.

Why it matters to the business

Systems handling medical imaging data can be crashed or compromised, disrupting healthcare workflows and risking exposure of sensitive patient information; widespread presence in older Ubuntu environments increases exposure across medical and research deployments.

How an attack unfolds

An attacker creates a malicious DICOM file that exploits the array index flaw in DCMTK's nowindow code path, delivers the file to a vulnerable application, and triggers processing to achieve an out-of-bounds write for potential code execution or denial of service.

How to fix it

Upgrade affected Ubuntu packages to the listed fixed versions such as linux 3.13.0-126.175, linux-aws 4.4.0-1002.2, linux-azure 4.15.0-1023.24~14.04.1, linux-lts-xenial 4.4.0-67.88~14.04.1, and equivalent updates for 16.04 and 18.04 series packages; replace or rebuild DCMTK installations with patched versions.

How to confirm the fix worked

Confirm installed package versions match or exceed the fixed versions provided for each Ubuntu release; test DICOM processing with known-good and boundary-case files to verify no crashes occur.

Typical attack path

1. Craft a malicious DICOM file targeting the nowindow functionality
2. Deliver the file to a system running vulnerable DCMTK
3. Induce the target application to process the file
4. Trigger out-of-bounds write for code execution or crash

How to detect it

Review application logs for unexpected crashes or errors during DICOM parsing, inspect file ingestion pipelines for anomalous DICOM headers, and correlate with process terminations in DCMTK-related binaries.

What your security team should do

• Prioritize patching all listed Ubuntu packages within the next maintenance window due to buffer overflow risk
• Inventory and replace any embedded or third-party DCMTK 3.6.8 deployments
• Restrict untrusted DICOM file ingestion until updates are applied
• Monitor for new exploit maturity indicators given stable but non-zero EPSS