CVE-2025-9732: Offis Dcmtk Buffer Overflow Vulnerability

CVE-2025-9732 Overview

CVE-2025-9732 is a memory corruption vulnerability in the DICOM Toolkit (DCMTK) developed by OFFIS e.V. The flaw affects DCMTK versions up to 3.6.9 and resides in the dcmimage/include/dcmtk/dcmimage/diybrpxt.h header used by the dcm2img component. Attackers with local access can trigger memory corruption by supplying a crafted YBR_FULL DICOM image to affected utilities. The vulnerability maps to CWE-119 (improper restriction of operations within the bounds of a memory buffer) and CWE-787 (out-of-bounds write). OFFIS has published a fix under commit 7ad81d69b.

Critical Impact
Local processing of a malformed DICOM YBR_FULL image can corrupt memory in dcm2img, potentially impacting confidentiality, integrity, and availability of medical imaging workflows.

Affected Products

OFFIS DCMTK versions up to and including 3.6.9
dcm2img utility shipped with DCMTK
Applications linking against the dcmimage library headers (diybrpxt.h, dicopxt.h)

Discovery Timeline

2025-08-31 - CVE-2025-9732 published to the National Vulnerability Database (NVD)
2025-08-31 - OFFIS commit 7ad81d69b published to the DCMTK GitHub repository
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2025-9732

Vulnerability Analysis

DCMTK is a widely deployed open-source C++ toolkit for parsing, rendering, and converting Digital Imaging and Communications in Medicine (DICOM) files. The dcm2img tool uses templates in dcmimage/include/dcmtk/dcmimage/diybrpxt.h and dicopxt.h to decode pixel data across color models, including YBR_FULL. When the toolkit processes a YBR_FULL image whose declared pixel count exceeds the input pixels actually available, the color pixel template writes and zero-fills a buffer region based on the declared count. This triggers memory corruption on the intermediate pixel planes.

Exploitation requires local access and low privileges. User interaction is not required beyond invoking dcm2img or another DCMTK-linked program on the malformed file. Impacts on confidentiality, integrity, and availability are partial rather than complete because the corruption is scoped to the image processing buffers.

Root Cause

The root cause is an out-of-bounds write ([CWE-787]) in the DiColorPixelTemplate::Init() path. When InputCount < Count, the pre-patch code called OFBitmanipTemplate<T>::zeroMem(Data[j] + InputCount, Count - InputCount) without adequately validating that the destination plane Data[j] was sized to accommodate the difference for the invalid YBR_FULL configuration. Crafted DICOM headers can force a mismatch between allocated plane size and the Count value used for the zero-fill.

Attack Vector

An attacker delivers a malicious DICOM file to a workstation or server that automatically processes incoming images with DCMTK-based tooling. Local processing of the file by dcm2img, or by any downstream application linking dcmimage, invokes the vulnerable template and corrupts memory during pixel plane initialization.

// Patch excerpt from dcmimage/include/dcmtk/dcmimage/dicopxt.h
// Source: https://github.com/DCMTK/dcmtk/commit/7ad81d69b
                 {
                     /* erase empty part of the buffer (=blacken the background) */
                     if (InputCount < Count)
-                        OFBitmanipTemplate<T>::zeroMem(Data[j] + InputCount, Count - InputCount);
+                    {
+                        const size_t count = (Count - InputCount);
+                        DCMIMAGE_TRACE("filing empty part of the intermediate pixel data (" << count << " pixels) of plane " << j << " with value = 0");
+                        OFBitmanipTemplate<T>::zeroMem(Data[j] + InputCount, count);
+                    }
                 } else {
                     DCMIMAGE_DEBUG("cannot allocate memory buffer for 'Data[" << j << "]' in DiColorPixelTemplate::Init()");
                     result = 0;     // at least one buffer could not be allocated!

The patch scopes the zero-fill length into a const size_t and adds trace logging around the operation, aligning the fill size with the intended plane boundary. See the OFFIS DCMTK security commit 7ad81d69b for the full change set.

Detection Methods for CVE-2025-9732

Indicators of Compromise

Crashes, aborts, or ASan reports from dcm2img or other DCMTK-linked binaries while processing YBR_FULL photometric interpretation DICOM files.
DICOM files whose declared Rows, Columns, or NumberOfFrames fields imply a larger pixel count than the actual pixel data payload.
Unexpected memory sanitizer alerts in imaging pipelines referencing DiColorPixelTemplate::Init or diybrpxt.h.

Detection Strategies

Inventory hosts running DCMTK 3.6.9 or earlier by hashing dcm2img and comparing library versions from dcmtk-config --version.
Add file-format inspection at ingress gateways to flag DICOM files with PhotometricInterpretation = YBR_FULL that fail structural validation.
Run DCMTK utilities under AddressSanitizer in staging to surface out-of-bounds writes on suspect files before production processing.

Monitoring Recommendations

Alert on unexpected process termination of dcm2img, dcmj2pnm, and other DCMTK tools invoked by PACS or radiology workflows.
Track file provenance for DICOM images entering the environment, particularly those from external referrers or untrusted modalities.
Correlate imaging-service crashes with recent DICOM file arrivals in your Security Information and Event Management (SIEM) platform.

How to Mitigate CVE-2025-9732

Immediate Actions Required

Upgrade DCMTK to a build that includes commit 7ad81d69b or later, and rebuild all downstream applications that statically link dcmimage.
Restrict which local accounts and services can invoke dcm2img on untrusted DICOM inputs.
Quarantine DICOM files received from untrusted or unauthenticated sources until they pass structural validation.

Patch Information

OFFIS resolved the issue in DCMTK commit 7ad81d69b, which corrects the zero-fill length calculation in DiColorPixelTemplate::Init() and updates copyright headers to 2025. Distributions packaging DCMTK 3.6.9 should backport this commit or upgrade to a subsequent release incorporating the fix. Additional context is available at VulDB entry 322023.

Workarounds

Disable or sandbox dcm2img invocations on ingestion pipelines until patched binaries are deployed.
Pre-validate incoming DICOM files with an independent parser to reject images whose declared pixel geometry does not match payload length.
Run DCMTK utilities inside isolated containers with seccomp and non-root users to contain the impact of memory corruption.

bash

# Build DCMTK from the patched commit
git clone https://github.com/DCMTK/dcmtk.git
cd dcmtk
git checkout 7ad81d69b
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
make -j"$(nproc)"
sudo make install

# Verify installed version and reject YBR_FULL files that fail validation
dcm2img --version
dcmdump +P PhotometricInterpretation suspect.dcm | grep -i YBR_FULL