Skip to main content

Dcmtk

8 CVEs product

Monthly

CVE-2026-5663 MEDIUM PATCH This Month

OS command injection in OFFIS DCMTK's storescp utility (versions up to 3.7.0) allows unauthenticated remote attackers to execute arbitrary system commands via crafted DICOM network operations. The vulnerability resides in the executeOnReception and executeOnEndOfStudy functions within dcmnet/apps/storescp.cc. With a CVSS score of 7.3 and network attack vector requiring no authentication, this presents significant risk to medical imaging systems using vulnerable DCMTK versions. Vendor patch edbb085e45788dccaf0e64d71534cfca925784b8 is available; no public exploit identified at time of analysis.

Command Injection Dcmtk
NVD VulDB GitHub
CVSS 4.0
6.9
EPSS
0.8%
CVE-2025-9732 MEDIUM PATCH Monitor

A vulnerability was identified in DCMTK up to 3.6.9. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

Buffer Overflow Dcmtk Suse
NVD GitHub VulDB
CVSS 4.0
4.8
EPSS
0.0%
CVE-2025-2357 MEDIUM PATCH This Month

A vulnerability was found in DCMTK 3.6.9. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Buffer Overflow Dcmtk Red Hat Suse
NVD VulDB
CVSS 4.0
5.3
EPSS
0.4%
CVE-2025-25475 HIGH PATCH This Week

A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DICOM file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Null Pointer Dereference Denial Of Service Dcmtk Debian Linux Red Hat +1
NVD GitHub
CVSS 3.1
7.5
EPSS
0.6%
CVE-2025-25474 MEDIUM PATCH This Month

DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

Buffer Overflow Dcmtk Debian Linux Red Hat Suse
NVD
CVSS 3.1
6.5
EPSS
0.3%
CVE-2025-25472 MEDIUM PATCH This Month

A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

Buffer Overflow Denial Of Service Dcmtk Debian Linux Red Hat +1
NVD
CVSS 3.1
5.3
EPSS
0.3%
CVE-2024-52333 HIGH POC PATCH This Week

An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Buffer Overflow Dcmtk Suse
NVD
CVSS 3.1
8.4
EPSS
0.0%
CVE-2024-47796 HIGH POC PATCH This Week

An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Buffer Overflow Dcmtk Suse
NVD
CVSS 3.1
8.4
EPSS
0.0%
EPSS 1% CVSS 6.9
MEDIUM PATCH This Month

OS command injection in OFFIS DCMTK's storescp utility (versions up to 3.7.0) allows unauthenticated remote attackers to execute arbitrary system commands via crafted DICOM network operations. The vulnerability resides in the executeOnReception and executeOnEndOfStudy functions within dcmnet/apps/storescp.cc. With a CVSS score of 7.3 and network attack vector requiring no authentication, this presents significant risk to medical imaging systems using vulnerable DCMTK versions. Vendor patch edbb085e45788dccaf0e64d71534cfca925784b8 is available; no public exploit identified at time of analysis.

Command Injection Dcmtk
NVD VulDB GitHub
EPSS 0% CVSS 4.8
MEDIUM PATCH Monitor

A vulnerability was identified in DCMTK up to 3.6.9. Rated medium severity (CVSS 4.8), this vulnerability is low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

Buffer Overflow Dcmtk Suse
NVD GitHub VulDB
EPSS 0% CVSS 5.3
MEDIUM PATCH This Month

A vulnerability was found in DCMTK 3.6.9. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Buffer Overflow Dcmtk Red Hat +1
NVD VulDB
EPSS 1% CVSS 7.5
HIGH PATCH This Week

A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DICOM file. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Null Pointer Dereference Denial Of Service Dcmtk +3
NVD GitHub
EPSS 0% CVSS 6.5
MEDIUM PATCH This Month

DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

Buffer Overflow Dcmtk Debian Linux +2
NVD
EPSS 0% CVSS 5.3
MEDIUM PATCH This Month

A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Buffer Copy without Size Check vulnerability could allow attackers to overflow a buffer to corrupt adjacent memory.

Buffer Overflow Denial Of Service Dcmtk +3
NVD
EPSS 0% CVSS 8.4
HIGH POC PATCH This Week

An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Buffer Overflow Dcmtk Suse
NVD
EPSS 0% CVSS 8.4
HIGH POC PATCH This Week

An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Buffer Overflow Dcmtk Suse
NVD

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy