High-Severity DoS Flaw in Grassroots DICOM Exposes Medical Imaging Systems

CISA issued an advisory for CVE-2026-3650, a high-severity denial-of-service vulnerability in Grassroots DICOM (GDCM) 3.2.2), a C++ library used to process DICOM medical images in healthcare environments. The flaw is a memory leak (CWE-401) triggered when the library parses malformed DICOM files containing non-standard VR types in file meta information, leading to excessive memory allocation, heap exhaustion, and potential service disruption from a single read operation. The issue carries a CVSS v3.1 score of 7.5 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.

Researchers Volodymyr Bihunenko, Mykyta Mudryi, and Markiian Chaklosh of ARIMLABS reported the vulnerability to CISA. The agency said the bug could be exploited remotely by sending a specially crafted file and warned that affected organizations in the healthcare and public health sector worldwide may be exposed if they rely on the library. CISA reported no known public exploitation at publication time, but said no patch is currently available and that the maintainer did not respond to mitigation requests; in the meantime, it recommended reducing exposure by keeping affected systems off the public internet, segmenting networks behind firewalls, and securing remote access with up-to-date VPNs.