CVE-2019-11687

An issue was discovered in the DICOM Part 10 File Format in the NEMA DICOM Standard 1995 through 2019b and continuing in current implementations. The 128-byte preamble of a DICOM file that complies with this specification can contain arbitrary executable headers for multiple operating systems, including Portable Executable (PE) files for Windows and Executable and Linkable Format (ELF) files for Linux-based systems. This space is left unspecified so that dual-purpose files can be created. For example, dual-purpose TIFF/DICOM files are used in digital whole slide imaging applications in medicine. This design flaw enables system-wide compromise as malicious DICOM files are routinely shared between medical devices and hospital systems and transported via removable media for patient care coordination. To exploit this vulnerability, someone must execute the maliciously crafted file. These files can be executable even with the .dcm file extension. Anti-malware configurations at healthcare facilities often ignore medical imagery. DICOM files exist on systems that process protected health information, and successful exploitation could result in violations of regulatory compliance requirements such as HIPAA and FDA postmarket obligations.

• CWE-20
• CWE-20

• http://www.securityfocus.com/bid/108730
• https://github.com/d00rt/pedicomExploit, Third Party Advisory
• https://github.com/d00rt/pedicom/blob/master/doc/Attacking_Digital_Imaging_and_Communication_in_Medicine_%28DICOM%29_file_format_standard_-_Markel_Picado_Ortiz_%28d00rt%29.pdf
• https://labs.cylera.com/2019.04.16/pe-dicom-medical-malwareExploit, Technical Description, Third Party Advisory
• https://www.praetorian.com/blog/elfdicom-poc-malware-polyglot-exploiting-linux-based-medical-devices/
• http://www.securityfocus.com/bid/108730
• https://github.com/d00rt/pedicomExploit, Third Party Advisory
• https://github.com/d00rt/pedicom/blob/master/doc/Attacking_Digital_Imaging_and_Communication_in_Medicine_%28DICOM%29_file_format_standard_-_Markel_Picado_Ortiz_%28d00rt%29.pdf
• https://labs.cylera.com/2019.04.16/pe-dicom-medical-malwareExploit, Technical Description, Third Party Advisory

Published

May 2, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1168An elevation of privilege exists in the p2pimsvc service whe…7.8
• CVE-2019-11680KonaKart 8.9.0.0 is vulnerable to Remote Code Execution by u…
• CVE-2019-11682A buffer overflow in the SMTP response service in MailCarrie…
• CVE-2019-11683udp_gro_receive_segment in net/ipv4/udp_offload.c in the Lin…9.8
• CVE-2019-11684Improper Access Control in the RCP+ server of the Bosch Vide…9.8
• CVE-2019-11686Western Digital SanDisk X300, X300s, X400, and X600 devices:…5.5
• CVE-2019-11688An issue was discovered in ASUSTOR exFAT Driver through 1.0.…7.4
• CVE-2019-11689An issue was discovered in ASUSTOR exFAT Driver through 1.0.…8.1
• CVE-2019-1169An elevation of privilege vulnerability exists in Windows wh…7.8
• CVE-2019-11690gen_rand_uuid in lib/uuid.c in Das U-Boot v2014.04 through v…
• CVE-2019-11691A use-after-free vulnerability can occur when working with X…
• CVE-2019-11692A use-after-free vulnerability can occur when listeners are …