DEBIAN-CVE-2025-11266

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2025-11266
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-11266.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2025-11266
Upstream
Published
2025-12-12T21:15:51.653Z
Modified
2026-03-17T02:51:00.851542Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
[none]
Details

An out-of-bounds write vulnerability exists in the Grassroots DICOM library (GDCM). The issue is triggered during parsing of a malformed DICOM file containing encapsulated PixelData fragments (compressed image data stored as multiple fragments). This vulnerability leads to a segmentation fault caused by an out-of-bounds memory access due to unsigned integer underflow in buffer indexing. It is exploitable via file input, simply opening a crafted malicious DICOM file is sufficient to trigger the crash, resulting in a denial-of-service condition.

References

Affected packages

Debian:11 / gdcm

Package

Name
gdcm
Purl
pkg:deb/debian/gdcm?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.0.8-2
3.0.8-3
3.0.8-4
3.0.10-1~bpo11+1
3.0.10-1
3.0.11-1
3.0.12-1
3.0.13-1
3.0.13-2~bpo11+1
3.0.13-2
3.0.13-3
3.0.14-1
3.0.16-1
3.0.17-1~bpo11+1
3.0.17-1
3.0.17-2
3.0.17-3
3.0.17-4~bpo11+1
3.0.17-4
3.0.17-5
3.0.20-1
3.0.20-2
3.0.20-3
3.0.20-3+hurd.1
3.0.21-1
3.0.21-2
3.0.22-1
3.0.22-2
3.0.22-2.1~exp1
3.0.22-2.1
3.0.22-3
3.0.24-1
3.0.24-1+hurd.1
3.0.24-2
3.0.24-3
3.0.24-3+hurd.1
3.0.24-4
3.0.24-5
3.0.24-5+hurd.1
3.0.24-5+hurd.2
3.0.24-6
3.0.24-7
3.0.24-8
3.0.24-9

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-11266.json"

Debian:12 / gdcm

Package

Name
gdcm
Purl
pkg:deb/debian/gdcm?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.0.21-1
3.0.21-2
3.0.22-1
3.0.22-2
3.0.22-2.1~exp1
3.0.22-2.1
3.0.22-3
3.0.24-1
3.0.24-1+hurd.1
3.0.24-2
3.0.24-3
3.0.24-3+hurd.1
3.0.24-4
3.0.24-5
3.0.24-5+hurd.1
3.0.24-5+hurd.2
3.0.24-6
3.0.24-7
3.0.24-8
3.0.24-9

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-11266.json"

Debian:13 / gdcm

Package

Name
gdcm
Purl
pkg:deb/debian/gdcm?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

3.*
3.0.24-5
3.0.24-5+hurd.1
3.0.24-5+hurd.2
3.0.24-6
3.0.24-7
3.0.24-8
3.0.24-9

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-11266.json"

Debian:14 / gdcm

Package

Name
gdcm
Purl
pkg:deb/debian/gdcm?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.0.24-8

Affected versions

3.*
3.0.24-5
3.0.24-5+hurd.1
3.0.24-5+hurd.2
3.0.24-6
3.0.24-7

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-11266.json"