CVE-2025-14607

OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption

State: Published
Severity: 5.3 Medium
Published: Dec 13, 2025
Updated: Feb 24, 2026
Reserved: Dec 12, 2025

Description

A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X	VulDB
3.1	6.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
3.0	6.3 Medium	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C	VulDB
2.0	6.5 Medium	AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-119 Memory Corruption

Affected Products

Product	Versions
DCMTKOFFIS	3.6.0Affected 3.6.1Affected 3.6.2Affected 3.6.3Affected 3.6.4Affected 3.6.5Affected 3.6.6Affected 3.6.7Affected 3.6.8Affected 3.6.9Affected 3.7.0Not affected

References

VDB-336283 | OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruptionvdb-entrytechnical-description
VDB-336283 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
Submit #705036 | OFFIS DCMTK 3.6.9 Buffer Overflowthird-party-advisory
https://support.dcmtk.org/redmine/issues/1184issue-tracking
https://support.dcmtk.org/redmine/projects/dcmtk/activity?from=2025-12-02related
https://github.com/DCMTK/dcmtk/commit/4c0e5c10079392c594d6a7abd95dd78ac0aa556apatch
https://support.dcmtk.org/redmine/versions/19patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.