CVE-2026-5663

EUVD-2026-19243
A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.
Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.3 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 75.68%
Affected Products (NVD)
VendorProductVersion
offisdcmtk
𝑥
≤ 3.7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
dcmtk
bookworm
3.6.7-9~deb12u4
fixed
bullseye
postponed
bullseye (security)
vulnerable
forky
3.7.0+really3.7.0-7
fixed
sid
3.7.0+really3.7.0-7
fixed
trixie
3.6.9-5+deb13u2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
dcmtk
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
questing
ignored
resolute
needs-triage
xenial
ignored
Common Weakness Enumeration
References
https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8
https://machinespirits.com/advisory/2e1627/
https://support.dcmtk.org/redmine/issues/1194
https://vuldb.com/submit/786061
https://vuldb.com/vuln/355486
https://vuldb.com/vuln/355486/cti