CVE-2026-3650: Grassroots Dicom Gdcm

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

A memory leak exists in the Grassroots DICOM library (GDCM). The bug occurs when parsing malformed DICOM files with non-standard VR types in file meta information. The vulnerability leads to vast memory allocations and resource depletion, triggering a denial-of-service condition. A maliciously crafted file can fill the heap in a single read operation without properly releasing it.

Affected products

• Grassroots Grassroots Dicom Gdcm: version 3.2.2 only

Published 2026-03-26. Last modified 2026-06-17.