Vulnerability Spotlight: Multiple vulnerabilities in LEADTOOLS software

Summary: Cisco Talos discovered multiple vulnerabilities in LEADTOOLS imaging toolkits, version 20.0.2019.3.15, including a JPEG2000 heap overflow, DICOM packet-parsing flaws in libltdic.so causing integer overflows and heap corruption, an out-of-bounds read, an infinite loop, and a heap out-of-bounds write in DICOM tag parsing. Talos worked with LEAD Technologies under its coordinated disclosure policy to resolve the issues and make an update available to affected customers.
What's compelling: LEADTOOLS is built for medical systems, so these flaws - code execution, information disclosure, and denial of service triggered by crafted J2K images or DICOM packets - land in software handling patient imaging data.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2019-5085 CVE-2019-5090 CVE-2019-5091 CVE-2019-5092 CVE-2019-5093
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026