OFFIS DCMTK CVE-2025-14607

Requires an application built on OFFIS DCMTK version ≤3.6.9 to parse a maliciously crafted DICOM byte-string value element that drives DcmByteString::makeDicomByteString into the off-by-one/null-termination defect in dcbytstr.cc. Exploitation is LIMITED by the fact that DCMTK is a library: the attacker must reach a component that ingests attacker-controlled DICOM data (a receiving PACS/SCP network service, a file viewer, or a conversion pipeline), and the VulDB vector indicates some privilege (PR:L) is expected; impact is bounded (Low C/I/A), consistent with a single-byte overwrite rather than arbitrary code execution.

Signals converge on a genuinely MEDIUM-to-LOW real-world risk rather than an urgent priority. The VulDB-assigned CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) with Low impact on all three of VC/VI/VA scores 5.3, reflecting a bounded memory-corruption condition rather than clean code execution. EPSS is 0.27% (18th percentile), indicating low predicted exploitation likelihood, and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. The GitHub source evidence is the vendor fix commit (a null-terminator / off-by-one correction), NOT a weaponized proof-of-concept, so there is no public exploit identified at time of analysis. One caveat to flag explicitly: this is a library-level flaw in the DCMTK DICOM toolkit, so the 'attack can be launched remotely' claim and the AV:N / PR:L metrics are VulDB defaults whose real applicability depends entirely on how the embedding application exposes DICOM parsing (networked PACS node vs. local file viewer) - verify the actual deployment surface before treating it as remotely reachable. The Low C/I/A impacts are consistent with the patch, which adds a single null byte, suggesting a constrained overflow (likely crash/limited corruption) rather than reliable RCE.

An attacker supplies a malicious DICOM object with a crafted byte-string element whose length triggers the faulty path in DcmByteString::makeDicomByteString, and a DCMTK ≤3.6.9-based application (e.g. a PACS node, viewer, or conversion service) parses it, causing memory corruption. No public exploit exists - only the vendor patch commit is available - and the attack requires reaching a component that processes attacker-controlled DICOM data, with low (AC:L) complexity once that surface is reached.