DCMTK

DcmRLECodecDecoder::decodeFrame() (dcmdata/libsrc/dcrleccd.cc:583) calls memcpy(rleHeader, rleData, 64) without validating that the pixel fragment is at least 64 bytes. The sibling decode() function has this guard at line 193 but decodeFrame() does not. An 8-byte crafted RLE fragment causes ASan to confirm a heap-buffer-overflow READ of size 64, leaking up to 56 bytes of adjacent heap memory. Affects all third-party consumers of DcmPixelData::getUncompressedFrame().

The issue can be demonstrated with the attached PoC file: dcm2img -d rle_crash.dcm rle_crash.bmp

Reported 2026-05-19 by Arjun Basnet, Senior Security Researcher, Securin.