Which versions of Dcmtk are affected by EUVD-2026-19243?

OFFIS DCMTK storescp utility (versions ≤3.7.0) contains an unauthenticated OS command injection vulnerability that allows remote attackers to execute arbitrary system commands on medical imaging…. A patch is available.

How to fix or mitigate EUVD-2026-19243?

Within 24 hours: inventory all systems running OFFIS DCMTK storescp and identify current version numbers. Within 7 days: apply vendor patch (commit edbb085e45788dccaf0e64d71534cfca925784b8) to all affected systems and validate patching through version verification. Within 30 days: conduct network segmentation audit to restrict DICOM service access to authorized imaging devices only and review access logs for suspicious DICOM operations.

Dcmtk EUVD-2026-19243

Q: What is the CVSS score of EUVD-2026-19243?

EUVD-2026-19243 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

| CVE-2026-5663 MEDIUM

OS Command Injection (CWE-78)

2026-04-06 VulDB

Command Injection Dcmtk Offis

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Apr 06, 2026 - 14:30 euvd

EUVD-2026-19243

Analysis Generated

Apr 06, 2026 - 14:30 vuln.today

Patch released

Apr 06, 2026 - 14:30 nvd

Patch available

CVE Published

Apr 06, 2026 - 14:15 nvd

MEDIUM 6.9

DescriptionCVE.org

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

AnalysisAI

OS command injection in OFFIS DCMTK's storescp utility (versions up to 3.7.0) allows unauthenticated remote attackers to execute arbitrary system commands via crafted DICOM network operations. The vulnerability resides in the executeOnReception and executeOnEndOfStudy functions within dcmnet/apps/storescp.cc. With a CVSS score of 7.3 and network attack vector requiring no authentication, this presents significant risk to medical imaging systems using vulnerable DCMTK versions. Vendor patch edbb085e45788dccaf0e64d71534cfca925784b8 is available; no public exploit identified at time of analysis.

Technical ContextAI

DCMTK (DICOM Toolkit) is a widely-deployed open-source library for processing medical imaging data conforming to the DICOM standard. The storescp component is a DICOM Storage Service Class Provider application that receives and stores medical images from network sources. The vulnerability stems from CWE-78 (OS Command Injection) in the executeOnReception and executeOnEndOfStudy callback functions, which likely process user-controlled input from DICOM messages without proper sanitization before passing it to shell command execution. These functions are designed to trigger custom scripts when receiving images or completing a study, but insufficient input validation allows attackers to inject malicious command sequences. The CPE string cpe:2.3:a:offis:dcmtk identifies OFFIS DCMTK as the affected product across all platforms where it's deployed, typically in hospital PACS systems, imaging workstations, and medical device integrations.

RemediationAI

Apply the vendor-released patch commit edbb085e45788dccaf0e64d71534cfca925784b8 available at https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8, which addresses the command injection vulnerability in the storescp component. Organizations should upgrade to DCMTK versions incorporating this patch as soon as testing permits, prioritizing internet-facing or network-accessible DICOM storage systems. As an interim mitigation, restrict network access to storescp services using firewall rules to allow connections only from trusted DICOM sources, and review any custom executeOnReception or executeOnEndOfStudy scripts for unsafe shell command construction. Disable the affected callback functionality if not operationally required. Consult the official vendor advisory at https://support.dcmtk.org/redmine/issues/1194 for additional guidance and verify your deployment's exposure by checking the dcmnet/apps/storescp.cc implementation in your installed version.