Loading vulnerability…
Memory Leak DoS in Grassroots DICOM (GDCM) 3.2.2
CVE-2026-3650 is a high-severity memory leak vulnerability in the Grassroots DICOM library (GDCM) version 3.2.2. The flaw is triggered when GDCM parses malformed DICOM files containing non-standard VR types in file meta information. During parsing, memory is allocated excessively and not properly released, allowing a very small crafted file—reported as roughly 150 bytes—to trigger allocations of up to approximately 4.2 GB in a single read operation. This results in heap exhaustion and resource depletion, producing a denial-of-service condition in software and systems that embed or depend on GDCM, including medical imaging workflows such as PACS servers, diagnostic workstations, DICOM viewers, and related tooling.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes uncontrolled memory consumption, heap exhaustion, and denial of service. Affected applications may crash, hang, or become unresponsive while processing the malicious DICOM object. In operational environments, this can disrupt PACS availability, freeze diagnostic workstations during image review, exhaust memory across servers if repeated malicious files are processed, and temporarily take imaging archives or related medical imaging services offline. Available information indicates high availability impact with no stated confidentiality or integrity impact.
If you can’t patch tonight, do this now.
Until a fix is available, reduce exposure by ensuring affected GDCM-based systems are not directly reachable from the internet, placing imaging and control-system networks behind firewalls, and isolating them from general business networks. Validate incoming DICOM files at the network perimeter or ingestion point to detect malformed metadata, especially abnormal file meta information and non-standard VR usage. Apply operating-system resource controls such as process memory limits, cgroups, or equivalent containment to limit the blast radius of memory exhaustion. Where remote access is required, use up-to-date VPNs or similarly secure access paths. Perform impact analysis before deploying mitigations in clinical environments.
Patch, then assume compromise.
No patch or vendor fix is currently available according to the provided content. Organizations should monitor the GDCM project and downstream vendors for an updated release or backported fix, and upgrade affected components as soon as a corrected version becomes available. Because GDCM is commonly embedded transitively through frameworks and products, remediation should include software bill of materials and dependency review to identify direct and indirect use of GDCM 3.2.2 in deployed imaging systems and applications.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.