CVE-2019-11687

Vulnerability

The DICOM Part 10 File Format standard (1995 through 2019b, and continuing in current implementations) defines a 128-byte preamble in its file header that is left unspecified for application-specific use. This design flaw allows arbitrary executable headers, such as Portable Executable (PE) files for Windows and Executable and Linkable Format (ELF) files for Linux, to be embedded within a DICOM file. Specifically, a crafted file can be both a valid DICOM medical image and a standalone executable (a polyglot file). Affected versions include all implementations adhering to the NEMA DICOM Standard from 1995 onwards [1][2].

Exploitation

An attacker must create a polyglot file that combines executable code (e.g., PE or ELF) with a valid DICOM structure. The attacker then delivers this .dcm file to a target system, typically via removable media, email, or shared medical systems, relying on user interaction to execute the file. Since the .dcm extension is associated with imaging applications, and anti-malware configurations at healthcare facilities often ignore medical imagery, the file may bypass standard security controls. Once the file is executed (e.g., double-clicked or processed by image viewers that run embedded code), the malicious payload runs [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary code on the target system. This can lead to system-wide compromise, including unauthorized access to protected health information (PHI), disruption of medical device functionality, and violation of regulatory compliance requirements such as HIPAA and FDA postmarket obligations. The attack can affect both Windows and Linux-based systems used in healthcare, as demonstrated by proof-of-concept payloads PEDICOM (Windows) and ELFDICOM (Linux) [1][2][3].

Mitigation

As of the published date (2019-05-02), no official patch or update to the DICOM standard to address this design flaw has been released. The issue is intrinsic to the specification. Mitigations rely on administrative and technical controls: restrict execution of .dcm files, deploy anti-malware that inspects DICOM files, monitor for unusual file execution patterns, and implement strict access controls on systems processing medical images. Healthcare organizations should also follow vendor-specific guidance for DICOM-compliant devices [1][2].