CVE-2025-48429

Critical · 9.1

CVSS

9.1

EPSS

0.4%

Published

Dec 16, 2025

CISA due date

—

The record

An out-of-bounds read vulnerability exists in the RLECodec::DecodeByStreams functionality of Grassroot DICOM 3.024. A specially crafted DICOM file can lead to leaking heap data. An attacker can provide a malicious file to trigger this vulnerability.

Affected packages

Ecosystem	Package	Introduced	Fixed