CVE-2024-47796: Offis DCMTK Buffer Overflow Vulnerability

CVE-2024-47796 Overview

CVE-2024-47796 is an out-of-bounds write vulnerability in the nowindow functionality of OFFIS DCMTK 3.6.8, a widely deployed open-source toolkit for Digital Imaging and Communications in Medicine (DICOM). The flaw stems from improper array index validation when parsing DICOM files. A specially crafted DICOM file processed by a vulnerable DCMTK utility triggers a memory corruption condition that can lead to arbitrary code execution in the context of the user running the tool. The vulnerability is categorized under [CWE-119] (Improper Restriction of Operations within the Bounds of a Memory Buffer) and was reported through Cisco Talos as advisory TALOS-2024-2122.

Critical Impact
Processing a malicious DICOM file with a vulnerable DCMTK tool can result in out-of-bounds memory writes, enabling potential arbitrary code execution on the host handling medical imaging data.

Affected Products

OFFIS DCMTK 3.6.8
Debian LTS packages containing DCMTK 3.6.8
Downstream medical imaging applications embedding DCMTK 3.6.8

Discovery Timeline

2025-01-13 - CVE-2024-47796 published to NVD via Cisco Talos advisory TALOS-2024-2122
2025-01 - Debian LTS security update issued for DCMTK
2025-06 - Follow-up Debian LTS announcement referencing DCMTK fixes
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47796

Vulnerability Analysis

DCMTK provides libraries and command-line utilities for examining, constructing, and converting DICOM image files. The nowindow code path handles pixel data rendering when no explicit windowing (contrast/brightness mapping) is specified in the DICOM dataset. During this operation, the affected routine calculates an index into an internal buffer using values derived from attacker-controlled DICOM fields without proper bounds validation.

When the computed index exceeds the allocated buffer size, DCMTK writes attacker-influenced data outside the intended memory region. Exploitation requires a local user to open or convert a crafted DICOM file, which aligns with typical DCMTK workflows in radiology and PACS environments. Successful exploitation can corrupt adjacent heap or stack structures and pivot to arbitrary code execution in the process context.

Root Cause

The root cause is missing validation of an array index used during pixel data processing in the nowindow rendering path. DCMTK trusts index calculations derived from DICOM header fields (such as pixel dimensions and bit depth values) rather than enforcing bounds against the actual output buffer allocation. The upstream fix, applied in commit 89a6e399f1e17d08a8bc8cdaa05b2ac9a50cd4f6, adds the necessary boundary checks before the write operation.

Attack Vector

Exploitation requires local access and user interaction: a victim must open, view, or convert a malicious DICOM file with a DCMTK-based tool such as dcmj2pnm, dcm2img, or any downstream application linking libdcmimgle. The file can be delivered through email, shared imaging drives, PACS ingestion pipelines, or removable media. Because DCMTK is embedded in numerous clinical imaging workflows, an attacker who can place a file in an automated processing queue may achieve exploitation without direct user action.

No verified public proof-of-concept is available. See the Talos Intelligence Report TALOS-2024-2122 for the technical write-up.

Detection Methods for CVE-2024-47796

Indicators of Compromise

Unexpected crashes, segmentation faults, or heap corruption reports from DCMTK binaries such as dcmj2pnm, dcm2pnm, or dcmdjpeg when processing incoming DICOM files.
DICOM files with anomalous pixel geometry fields (Rows, Columns, BitsAllocated, BitsStored) that do not match declared pixel data length.
Child processes or shell activity spawned by DICOM viewer or conversion utilities that normally do not fork.

Detection Strategies

Inventory all systems running DCMTK 3.6.8 and identify downstream applications that statically or dynamically link libdcmimgle.
Deploy YARA or file-format inspection rules at ingestion gateways to flag DICOM files whose pixel data buffer sizes are inconsistent with declared dimensions.
Enable Address Sanitizer (ASan) or equivalent instrumentation in test environments to catch out-of-bounds writes when validating incoming DICOM samples.

Monitoring Recommendations

Monitor process telemetry for DCMTK utilities exhibiting abnormal memory access patterns, crashes, or unexpected child process creation.
Log and audit DICOM file sources on PACS ingestion points, correlating file origin with any downstream tool crash.
Track patch state of DCMTK across imaging workstations and containerized medical imaging services using endpoint inventory data.

How to Mitigate CVE-2024-47796

Immediate Actions Required

Upgrade DCMTK beyond version 3.6.8 or apply the upstream patch in commit 89a6e399f1e17d08a8bc8cdaa05b2ac9a50cd4f6 from the DCMTK Git repository.
Debian users should install the fixed packages referenced in the Debian LTS Announcement (January 2025) and the Debian LTS Announcement (June 2025).
Rebuild and redistribute any in-house software statically linked against the vulnerable DCMTK version.

Patch Information

The issue is resolved in DCMTK by commit 89a6e399f1e17d08a8bc8cdaa05b2ac9a50cd4f6, which introduces proper index bounds checking in the nowindow rendering path. Distribution maintainers, including Debian LTS, have backported the fix. Refer to the DCMTK Git commit for the exact code change.

Workarounds

Restrict DCMTK processing to trusted DICOM sources and reject files from unauthenticated or external senders until patched.
Run DCMTK utilities inside sandboxed or containerized environments with seccomp, AppArmor, or SELinux profiles that limit filesystem and process privileges.
Validate incoming DICOM files against expected pixel geometry constraints before passing them to DCMTK-based tools.

bash

# Verify installed DCMTK version and update on Debian-based systems
dcmdump --version | head -n 1
sudo apt-get update && sudo apt-get install --only-upgrade dcmtk libdcmtk17