CVE-2024-22373

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22373

8.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

A

n out-of-bounds write vulnerability exists in the JPEG2000Codec::DecodeByStreamsCommon functionality of Mathieu Malaterre Grassroot DICOM 3.0.23. A specially crafted DICOM file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

References
Link Resource
https://lists.fedoraproject.org/archives/list/[email protected]/message/BZJ4IG7EXMSMPHTK5ZFASCW6MHSOVZOE/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/N5HXUKUJ7SG3TK456SGUWVZ4Z5D7JKOL/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/WJA7QWWZWMY4AQFR35EA7S3CFVUTOQYG/ Mailing List
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1935 Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/[email protected]/message/BZJ4IG7EXMSMPHTK5ZFASCW6MHSOVZOE/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/N5HXUKUJ7SG3TK456SGUWVZ4Z5D7JKOL/ Mailing List
https://lists.fedoraproject.org/archives/list/[email protected]/message/WJA7QWWZWMY4AQFR35EA7S3CFVUTOQYG/ Mailing List
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1935 Exploit Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1935 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:malaterre:grassroots_dicom:3.0.23:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
History

16 Dec 2025, 19:17

Type Values Removed Values Added
CPE cpe:2.3:a:grassroots_dicom_project:grassroots_dicom:3.0.23:*:*:*:*:*:*:* cpe:2.3:a:malaterre:grassroots_dicom:3.0.23:*:*:*:*:*:*:*
First Time Malaterre grassroots Dicom
Malaterre
References () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1935 - () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1935 - Third Party Advisory

04 Nov 2025, 18:15

Type Values Removed Values Added
References
  • () https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1935 -

21 Aug 2025, 18:02

Type Values Removed Values Added
CPE cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:a:grassroots_dicom_project:grassroots_dicom:3.0.23:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
CWE CWE-787
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/BZJ4IG7EXMSMPHTK5ZFASCW6MHSOVZOE/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/BZJ4IG7EXMSMPHTK5ZFASCW6MHSOVZOE/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/N5HXUKUJ7SG3TK456SGUWVZ4Z5D7JKOL/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/N5HXUKUJ7SG3TK456SGUWVZ4Z5D7JKOL/ - Mailing List
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/WJA7QWWZWMY4AQFR35EA7S3CFVUTOQYG/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/WJA7QWWZWMY4AQFR35EA7S3CFVUTOQYG/ - Mailing List
References () https://talosintelligence.com/vulnerability_reports/TALOS-2024-1935 - () https://talosintelligence.com/vulnerability_reports/TALOS-2024-1935 - Exploit, Third Party Advisory
First Time Grassroots Dicom Project grassroots Dicom
Fedoraproject fedora
Fedoraproject
Grassroots Dicom Project

21 Nov 2024, 08:56

Type Values Removed Values Added
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/BZJ4IG7EXMSMPHTK5ZFASCW6MHSOVZOE/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/BZJ4IG7EXMSMPHTK5ZFASCW6MHSOVZOE/ -
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/N5HXUKUJ7SG3TK456SGUWVZ4Z5D7JKOL/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/N5HXUKUJ7SG3TK456SGUWVZ4Z5D7JKOL/ -
References () https://lists.fedoraproject.org/archives/list/[email protected]/message/WJA7QWWZWMY4AQFR35EA7S3CFVUTOQYG/ - () https://lists.fedoraproject.org/archives/list/[email protected]/message/WJA7QWWZWMY4AQFR35EA7S3CFVUTOQYG/ -
References () https://talosintelligence.com/vulnerability_reports/TALOS-2024-1935 - () https://talosintelligence.com/vulnerability_reports/TALOS-2024-1935 -

05 May 2024, 03:15

Type Values Removed Values Added
References
  • () https://lists.fedoraproject.org/archives/list/[email protected]/message/BZJ4IG7EXMSMPHTK5ZFASCW6MHSOVZOE/ -
  • () https://lists.fedoraproject.org/archives/list/[email protected]/message/N5HXUKUJ7SG3TK456SGUWVZ4Z5D7JKOL/ -
  • () https://lists.fedoraproject.org/archives/list/[email protected]/message/WJA7QWWZWMY4AQFR35EA7S3CFVUTOQYG/ -
Summary
  • (es) Existe una vulnerabilidad de escritura fuera de los límites en la funcionalidad JPEG2000Codec::DecodeByStreamsCommon de Mathieu Malaterre Grassroot DICOM 3.0.23. Un archivo DICOM especialmente manipulado puede provocar un desbordamiento de búfer de almacenamiento dinámico. Un atacante puede proporcionar un archivo malicioso para desencadenar esta vulnerabilidad.

25 Apr 2024, 17:15

Type Values Removed Values Added
References
  • {'url': 'https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1935', 'source': '[email protected]'}

25 Apr 2024, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-25 15:16

Updated : 2025-12-16 19:17

NVD link : CVE-2024-22373

Mitre link : CVE-2024-22373

CVE.ORG link : CVE-2024-22373

JSON object : View

Products Affected

fedoraproject

malaterre

CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-787

Out-of-bounds Write