DCMTK dcmdata组件DcmByteString::makeDicomByteString内存损坏漏洞(CVE-2025-14607)

// CVE-2025-14607 PoC - DCMTK dcmdata memory corruption // Target: DcmByteString::makeDicomByteString in dcbytstr.cc // Affected: DCMTK <= 3.6.9 #include <dcmtk/dcmdata/dctk.h> #include <fstream> int main(int argc, char* argv[]) { if (argc < 2) { std::cerr << "Usage: " << argv[0] << " <malicious_dcm_file>" << std::endl; return 1; } const char* filename = argv[1]; DcmFileFormat dcmff; OFCondition status = dcmff.loadFile(filename); if (status.bad()) { std::cerr << "Error loading file: " << status.text() << std::endl; return 1; } DcmDataset* dataset = dcmff.getDataset(); if (dataset) { // Trigger parsing of byte string elements // This may trigger the vulnerability in makeDicomByteString const char* patientName = nullptr; OFCondition cond = dataset->findAndGetString(DCM_PatientName, patientName); if (cond.good()) { std::cout << "Patient Name: " << patientName << std::endl; } } return 0; } // Note: Actual PoC requires crafting a DICOM file with specially // constructed byte string values that trigger memory corruption // in DcmByteString::makeDicomByteString function