CVE-2026-3650 Overview
A memory leak vulnerability exists in the Grassroots DICOM library (GDCM), a widely used open-source library for processing DICOM (Digital Imaging and Communications in Medicine) files in healthcare and medical imaging applications. The vulnerability occurs when parsing malformed DICOM files containing non-standard VR (Value Representation) types in file meta information. Exploitation of this flaw leads to massive memory allocations and resource depletion, ultimately triggering a denial-of-service condition. A maliciously crafted DICOM file can fill the heap memory in a single read operation without properly releasing allocated resources.
Critical Impact
This memory exhaustion vulnerability in medical imaging software can cause denial-of-service conditions in healthcare environments, potentially disrupting critical diagnostic imaging workflows and patient care systems.
Affected Products
- Grassroots DICOM (GDCM) Library
- Applications and medical imaging systems utilizing the GDCM library
- Healthcare software implementing GDCM for DICOM file parsing
Discovery Timeline
- 2026-03-26 - CVE CVE-2026-3650 published to NVD
- 2026-03-26 - Last updated in NVD database
Technical Details for CVE-2026-3650
Vulnerability Analysis
This vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), commonly known as a memory leak. The flaw resides in GDCM's DICOM file parsing logic, specifically in how the library handles non-standard VR types within file meta information headers. When processing a malformed DICOM file, the parser allocates memory for each encountered element but fails to properly release these allocations when encountering unexpected or non-standard VR types, leading to unbounded memory growth.
The DICOM standard defines specific Value Representation types that describe how data elements should be stored and interpreted. When GDCM encounters a malformed file with invalid or non-standard VR types in the file meta information section, the parsing routine continues allocating memory without proper cleanup, resulting in progressive heap exhaustion.
Root Cause
The root cause is improper memory management in the DICOM parsing code path. When the library encounters malformed DICOM data with non-standard VR types, it allocates memory buffers for processing but lacks corresponding deallocation logic in the error handling paths. This results in orphaned memory allocations that accumulate during file parsing operations.
The vulnerability is particularly severe because a single malicious file can trigger massive memory allocations in a single read operation, rapidly consuming available system memory without any gradual warning signs that would allow defensive measures.
Attack Vector
The attack can be executed remotely via network-accessible services that process DICOM files. An attacker can craft a malicious DICOM file containing non-standard VR types in the file meta information header and deliver it to any system or application using the vulnerable GDCM library for DICOM processing. This could include:
- Medical imaging systems receiving DICOM files over network protocols
- PACS (Picture Archiving and Communication Systems) servers
- Healthcare applications with DICOM import functionality
- Research and analysis tools processing DICOM datasets
The attack requires no authentication and no user interaction beyond the target system processing the malicious file, making it highly exploitable in automated DICOM processing pipelines.
Detection Methods for CVE-2026-3650
Indicators of Compromise
- Sudden and abnormal memory consumption spikes in processes utilizing GDCM library
- System or application crashes related to out-of-memory conditions during DICOM file processing
- Unusual DICOM files with non-standard or malformed VR types in file meta information headers
- Service unavailability in medical imaging applications following DICOM file ingestion
Detection Strategies
- Monitor memory consumption patterns for GDCM-dependent applications and establish baseline thresholds
- Implement DICOM file validation checks to detect non-standard VR types before processing
- Deploy application-level monitoring to detect abnormal memory allocation patterns during file parsing operations
- Configure system resource limits and alerting for DICOM processing services
Monitoring Recommendations
- Enable detailed logging for DICOM file parsing operations to capture metadata about processed files
- Implement heap monitoring and memory profiling for applications using GDCM library
- Set up alerts for rapid memory growth patterns in medical imaging services
- Monitor for repeated service restarts or crashes in DICOM processing components
How to Mitigate CVE-2026-3650
Immediate Actions Required
- Review all systems and applications using the GDCM library and assess exposure
- Implement input validation to reject DICOM files with non-standard VR types before GDCM processing
- Configure memory limits and resource constraints for DICOM processing services
- Consider temporary isolation of DICOM file ingestion services from untrusted sources until patches are applied
- Monitor CISA ICS Medical Advisory ICSMA-26-083-01 for updated guidance
Patch Information
Organizations should monitor the GDCM project on SourceForge for security updates addressing this vulnerability. Additionally, review the CISA Medical Advisory ICSMA-26-083-01 for vendor-specific patch information and recommended actions. Technical details may also be available in the GitHub CSAF document.
Workarounds
- Implement process-level memory limits using operating system controls (ulimit, cgroups) to prevent complete system exhaustion
- Deploy DICOM validation middleware to pre-screen incoming files for malformed VR types before GDCM processing
- Isolate DICOM processing services in containerized environments with strict memory constraints
- Implement file size and complexity limits for incoming DICOM files to reduce attack surface
# Example: Configure memory limits for DICOM processing service using systemd
# Add to service unit file [Service] section
MemoryLimit=2G
MemoryMax=2G
OOMScoreAdjust=500
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
