Vulnerability · Published Mar 26, 2026 · Assigned by icscert
CVE-2026-3650Grassroots DICOM Missing release of memory after effective lifetime
High 7.5
In plain English
A high-severity memory leak in Grassroots DICOM (GDCM) from Grassroots. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-standard VR types in file meta information. The vulnerability leads to vast memory allocations and resource depletion, triggering a denial-of-service condition. A maliciously crafted file can fill the heap in a single read operation without properly releasing it.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | gdcm | no fix listed | DEBIAN-CVE-2026-3650 |
| Debian:13 | gdcm | no fix listed | DEBIAN-CVE-2026-3650 |
| Debian:14 | gdcm | 3.0.24-11 | DEBIAN-CVE-2026-3650 |
| Ubuntu:22.04:LTS | gdcm | no fix listed | UBUNTU-CVE-2026-3650 |
| Ubuntu:24.04:LTS | gdcm | no fix listed | UBUNTU-CVE-2026-3650 |
| Ubuntu:25.10 | gdcm | no fix listed | UBUNTU-CVE-2026-3650 |
| Ubuntu:26.04:LTS | gdcm | no fix listed | UBUNTU-CVE-2026-3650 |
| Ubuntu:26.10 | gdcm | no fix listed | UBUNTU-CVE-2026-3650 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Grassroots | Grassroots DICOM (GDCM) | 3.2.2 |
Weakness: CWE-401 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H