[Debian-med-packaging] Bug#1122862: gdcm: CVE-2025-11266

[Salvatore Bonaccorso]

Source: gdcm
Version: 3.0.24-7
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerability was published for gdcm.

CVE-2025-11266[0]:
| An out-of-bounds write vulnerability exists in the Grassroots DICOM
| library (GDCM). The issue is triggered during parsing of a malformed
| DICOM file containing encapsulated PixelData fragments (compressed
| image data stored as multiple fragments). This vulnerability leads
| to a segmentation fault caused by an out-of-bounds memory access due
| to unsigned integer underflow in buffer indexing. It is exploitable
| via file input, simply opening a crafted malicious DICOM file is
| sufficient to trigger the crash, resulting in a denial-of-service
| condition.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-11266
    https://www.cve.org/CVERecord?id=CVE-2025-11266
[1] https://github.com/malaterre/GDCM/commit/5829c95c8ac3afa9a3a3413675e948959c28a789

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore