CVE-2025-14607
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability was detected in OFFIS DCMTK up to version 3.6.9, affecting the function DcmByteString::makeDicomByteString in the file dcmdata/libsrc/dcbytstr.cc of the dcmdata component. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 resolves the issue.
Risk Assessment
Memory corruption could lead to application crashes and, in extreme cases, remote code execution, posing a serious risk to system integrity.
Recommendation
Upgrade DCMTK to version 3.7.0 or later, which includes the fix. Also restrict access to services using DCMTK.
Other vulnerabilities in DCMTK
See all- CVE-2026-44038Medium
A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries in OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a crafted JPEG stream with a Huffman table defining a difference category above 15.
- CVE-2026-44037Medium
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values.
- CVE-2026-44036Medium
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML file with deeply nested sequence and item elements.
- CVE-2026-44035Medium
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute.
- CVE-2026-50003Critical
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
- CVE-2026-97059High
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains.
- CVE-2026-10194Medium
A heap-based buffer overflow vulnerability was discovered in DCMTK 3.7.0 in the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages in file dcmqrdb/libsrc/dcmqrdbi.cc. Remote attack is possible. A patch is available with ID 0f78a4ef6f645ea5530166e445e5436a5de58e75.
Original NVD description (English source)
A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS