CVE-2025-2581

Name	CVE-2025-2581
Description	A vulnerability has been found in xmedcon 0.25.0 and classified as problematic. Affected by this vulnerability is the function malloc of the component DICOM File Handler. The manipulation leads to integer underflow. The attack can be launched remotely. Upgrading to version 0.25.1 is able to address this issue. It is recommended to upgrade the affected component.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4237-1
Debian Bugs	1100986

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xmedcon (PTS)	bullseye	0.16.3+dfsg-1+deb11u1	vulnerable
	bullseye (security)	0.16.3+dfsg-1+deb11u2	fixed
	bookworm	0.23.0-gtk3+dfsg-1+deb12u2	fixed
	forky, sid, trixie	0.25.1-gtk3+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
xmedcon	source	bullseye	0.16.3+dfsg-1+deb11u2	DLA-4237-1
xmedcon	source	bookworm	0.23.0-gtk3+dfsg-1+deb12u2
xmedcon	source	(unstable)	0.25.1-gtk3+dfsg-1		1100986

Notes

https://xmedcon.sourceforge.io/Main/New
https://sourceforge.net/p/xmedcon/code/ci/e7a88836fc2277f8ab777f3ef24f917d08415559/
affects only arches where int64_t != size_t (32 bits arches)