CVE-2026-3650: Grassroots DICOM (GDCM) Memory Leak — Detection and Mitigation

---
title: Potential Malicious DICOM File Creation via Script
id: 8a2b3c4d-5e6f-7g8h-9i0j-1k2l3m4n5o6p
status: experimental
description: Detects the creation of DICOM files (.dcm, .dicom, .dicm, .ima) by suspicious processes often used in staging or scripting attacks.
references:
  - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-083-01
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: file_creation
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.dcm'
      - '.dicom'
      - '.dicm'
      - '.ima'
  filter_legit:
    Image|contains:
      - '\PACS\'
      - '\Radiology\'
      - '\MedicalImaging\'
  condition: selection and not filter_legit
falsepositives:
  - Legitimate export of medical images by staff to non-standard directories.
level: medium
---
title: Application Crash Indicating Memory Exhaustion
id: 9b3c4d5e-6f7g-8h9i-0j1k-2l3m4n5o6p7q
status: experimental
description: Detects application crashes in common medical imaging viewers that may indicate a memory leak exploit attempt.
references:
  - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-083-01
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: application_restart
  product: windows
detection:
  selection:
    SubjectUserName|contains:
      - 'radiology'
      - 'pacs'
      - 'admin'
  condition: selection
falsepositives:
  - Routine application updates or known instability in legacy viewer software.
level: high

// Hunt for creation of DICOM files by potentially suspicious processes
DeviceFileEvents
| where Timestamp > ago(7d)
| where FileName has_any ('.dcm', '.dicom', '.dicm', '.ima', '.acr', '')
| where InitiatingProcessFolderPath !contains @"Program Files" 
and InitiatingProcessFolderPath !contains @"Windows"
| project Timestamp, DeviceName, FileName, FolderPath, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| order by Timestamp desc

-- Hunt for GDCM libraries and recent DICOM file modifications
SELECT 
  FullPath, 
  Mtime, 
  Size, 
  Sys.
  FROM glob(globs="/**/*.dcm")
WHERE Mtime > now() - 7d

-- Check for vulnerable GDCM binaries (Linux)
SELECT FullPath, Version
FROM glob(globs="/usr/lib/**/libgdcm*.so*")
WHERE parse_string(FullPath, regex="(?P<ver>3.2.2)")

<#
.SYNOPSIS
    Audit for vulnerable GDCM library versions on Windows endpoints.
.DESCRIPTION
    Scans common program directories for gdcm.dll and checks file version.
#>

$VulnerableVersion = "3.2.2"
$SearchPaths = @("C:\Program Files\", "C:\Program Files (x86)\")
$Findings = @()

foreach ($Path in $SearchPaths) {
    if (Test-Path $Path) {
        $Dlls = Get-ChildItem -Path $Path -Filter "gdcm.dll" -Recurse -ErrorAction SilentlyContinue
        foreach ($Dll in $Dlls) {
            $VersionInfo = $Dll.VersionInfo.FileVersion
            if ($VersionInfo -like "*$VulnerableVersion*") {
                $Findings += [PSCustomObject]@{
                    Path = $Dll.FullName
                    Version = $VersionInfo
                    Status = "VULNERABLE"
                }
            }
        }
    }
}

if ($Findings.Count -gt 0) {
    Write-Host "[ALERT] Vulnerable GDCM libraries found:" -ForegroundColor Red
    $Findings | Format-Table -AutoSize
} else {
    Write-Host "[INFO] No vulnerable GDCM 3.2.2 libraries found in standard paths." -ForegroundColor Green
}