CVE-2024-52333

What it actually does

Improper array index validation in determineMinMax allows a specially crafted DICOM file to trigger an out-of-bounds write in DCMTK 3.6.8.

Why it matters to the business

Medical imaging and DICOM processing systems may crash, corrupt data, or allow arbitrary code execution, disrupting clinical workflows and requiring urgent patching across deployments that depend on the vulnerable library.

How an attack unfolds

An attacker crafts a malicious DICOM file that exploits the index validation flaw during determineMinMax processing; the file is supplied to the target application, triggering the out-of-bounds write and potential code execution.

How to fix it

Upgrade affected packages to the listed fixed versions: web2py (Ubuntu:16.04:LTS) fixed in 2.12.3-1ubuntu0.1. Apply vendor patches for DCMTK once released and rebuild dependent applications.

How to confirm the fix worked

Confirm upgraded package versions match the fixed releases, reprocess sample DICOM files that previously triggered the flaw, and verify no out-of-bounds behavior occurs in determineMinMax.

Typical attack path

1. Craft malicious DICOM file targeting determineMinMax index handling
2. Deliver file to victim system or application that processes DICOM
3. Trigger file parsing to cause out-of-bounds write
4. Leverage memory corruption for code execution or denial of service

How to detect it

Review application logs for crashes or errors during DICOM parsing around determineMinMax; inspect inbound DICOM files for anomalous array indices or unexpected sizes.

What your security team should do

• Prioritize patching systems handling DICOM files due to memory corruption risk
• Inventory all deployments using DCMTK 3.6.8 or the listed web2py packages
• Implement file-type validation and sandboxing for untrusted DICOM input
• Monitor for new fixed releases from OFFIS and Ubuntu