Which versions of Grassroots Dicom Gdcm are affected by CVE-2026-3650?

Grassroots DICOM (GDCM) library versions processing malformed medical imaging files are vulnerable to remote denial-of-service attacks that exhaust system memory without requiring authentication or…

How to fix or mitigate CVE-2026-3650?

Within 24 hours: Inventory all medical imaging systems and applications using GDCM library; document affected versions and deployment scope. Within 7 days: Contact GDCM vendor and DICOM system vendors for patch availability and timeline; implement input validation on DICOM file uploads where technically feasible. Within 30 days: Apply vendor-released patch immediately upon availability; if no patch released by vendor within 30 days, execute compensating controls (network segmentation, file validation, access restrictions) and establish monitoring for exploitation attempts.

Grassroots Dicom Gdcm CVE-2026-3650

Q: What is the CVSS score of CVE-2026-3650?

CVE-2026-3650 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16450 HIGH

Memory Leak (CWE-401)

2026-03-26 icscert

Information Disclosure Red Hat Suse Grassroots Dicom Gdcm

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 26, 2026 - 21:31 euvd

EUVD-2026-16450

Analysis Generated

Mar 26, 2026 - 21:31 vuln.today

CVE Published

Mar 26, 2026 - 21:10 nvd

HIGH 8.7

DescriptionCVE.org

A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-standard VR types in file meta information. The vulnerability leads to vast memory allocations and resource depletion, triggering a denial-of-service condition. A maliciously crafted file can fill the heap in a single read operation without properly releasing it.

AnalysisAI

Malformed DICOM files with non-standard VR types trigger uncontrolled memory allocation in Grassroots DICOM (GDCM) library, enabling remote denial-of-service attacks without authentication. CISA ICS-CERT issued an ICSMA advisory (26-083-01) highlighting impacts to medical imaging systems that rely on GDCM for DICOM parsing. The vulnerability allows heap exhaustion from a single malicious file read operation, with CVSS 7.5 (High severity, network-accessible, no privileges required). No public exploit identified at time of analysis.

Technical ContextAI

Grassroots DICOM (GDCM) is an open-source C++ library for parsing and processing DICOM (Digital Imaging and Communications in Medicine) files, the standard format for medical imaging data. The affected product is identified via CPE cpe:2.3:a:grassroots:grassroots_dicom_(gdcm):*:*:*:*:*:*:*:*, indicating all versions are potentially vulnerable. The root cause is CWE-401 (Missing Release of Memory after Effective Lifetime), where the parser allocates vast heap memory when encountering malformed VR (Value Representation) types in DICOM file meta information headers but fails to properly deallocate resources when parsing errors occur. This class of vulnerability commonly arises in file format parsers that lack defensive resource limits and error-path cleanup logic.

RemediationAI

Organizations using Grassroots DICOM library should monitor the official project repository at https://sourceforge.net/projects/gdcm/ and CISA advisory at https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-083-01 for patch availability and upgrade guidance. Until vendor-supplied patches are applied, implement network-layer controls to restrict DICOM file ingestion to trusted sources only, deploy file validation and sanitization at network boundaries, and configure resource limits (memory quotas, process isolation) for DICOM parsing services to contain denial-of-service impact. Medical device operators should consult equipment manufacturers for firmware updates incorporating patched GDCM versions and follow ICS-CERT recommendations for defense-in-depth including network segmentation of medical imaging zones. Review the CSAF machine-readable advisory at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-083-01.json for additional vendor-specific guidance.