CVE-2024-28130

CVE-2024-28130 affects OFFIS DCMTK 3.6.8 (DVPSSoftcopyVOI_PList::createFromImage) with a malformed file enabling arbitrary code execution. Public references in Debian (DCMTK 3.6.5-1+deb11u1 fix), Ubuntu security advisory USN-7010-1, and Fedora dcmtk 3.6.9-2.fc42 indicate multiple distributions ha...

CVE-2021-41687

DCMTK has a memory free issue in versions up to 3.6.6 (CVE-2021-41687) where allocated heap memory during parsing may not be freed on parsing errors, enabling a DoS via crafted requests to dcmqrdb. Public advisories (Ubuntu USN-7010-1, Debian DLA-4038-1, Debian 10/DLA-3847, Mageia MGASA-2024-0251...

CVE-2025-25475

CVE-2025-25475 affects DCMTK v3.6.9+ DEV and is caused by a NULL pointer dereference in /libsrc/dcrleccd.cc, enabling a crafted DICOM file to trigger a Denial of Service. Connected advisories confirm this issue and note fixes in various Linux distros (e.g., Debian DLA-4227, openSUSE SUSE advisory...

CVE-2021-41688

CVE-2021-41688 affects DCMTK up to version 3.6.6, where improper memory management in DCMTK’s dcmqrdb handling can lead to a double free and a resulting denial of service. The vulnerability is described as: an object is freed while its address remains in use, allowing specific requests to trigger...

CVE-2025-2357

DCMTK 3.6.9 contains a memory-corruption vulnerability in the dcmjpls JPEG-LS Decoder. The issue can be exploited remotely, with exploitation information reported publicly. A patch named 3239a7915 is referenced as fixes for this issue; applying the patch is the advised remediation. The CVE descri...

CVE-2022-2121

CVE-2022-2121 affects OFFIS DCMTK: all versions before 3.6.7 are vulnerable to a NULL pointer dereference when processing DICOM files, which may lead to denial of service. Remediation is to upgrade to DCMTK 3.6.7 or newer; multiple advisories (Debian, Mageia, openSUSE, Astra Linux) note DCMTK upd...

CVE-2021-41689

DCMTK 3.6.6 and earlier contains a NULL pointer dereference and potential head-based overflow in dcmqrdb due to improper handling of string copy, allowing remote DoS via crafted requests. Public advisories confirm this vulnerability (CVE-2021-41689) and reference multiple vendor patches: Debian f...

CVE-2021-41690

DCMTK (up to 3.6.6) is affected by CVE-2021-41690, which describes improper freeing of memory where malloced file-info structures stored in a global LST are not freed, enabling a potential DoS via memory leak in dcmqrdb. Connected advisories (Debian, Debian LTS, Mageia, Ubuntu USN, Fedora Nessus,...

CVE-2022-43272

CVE-2022-43272 affects DCMTK v3.6.7, with a memory leak in the single-process path related to T_ASC_Association (notably in ASC_receiveAssociation and parseUserInfo flows). The issue is a memory leak rather than an explicit remote code execution or crash in the presented docs, and exploitation de...

CVE-2013-6825

CVE-2013-6825 affects DCMTK 3.6.1 and earlier, with multiple components (movescu, storescp, scp, wlmactmg, dcmprscp, dcmpsrcv, dcmpstat tests, and dcmqrscp) failing to check the return value of the setuid call. This permits local privilege escalation by spawning a large number of processes. Conne...

CVE-2025-9732

Summary of CVE-2025-9732 (DCMTK) : A memory corruption vulnerability exists in DCMTK up to version 3.6.9, triggered by manipulating an unknown function in dcmimage/include/dcmtk/dcmimage/diybrpxt.h within the dcm2img component. The issue requires local access to exploit and is attributed to impro...