CVE-2026-12805 | Medium | 6.3 | 2026-06-21 | A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a man… |
CVE-2026-10194 | Medium | 6.3 | 2026-05-31 | A weakness has been identified in OFFIS DCMTK 3.7.0. This affects the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages of the file dcmqrdb/libs… |
CVE-2026-5663 | High | 7.3 | 2026-04-06 | A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/stores… |
CVE-2025-14841 | Low | 3.3 | 2025-12-18 | A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIn… |
CVE-2025-14607 | Medium | 6.3 | 2025-12-13 | A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/d… |
CVE-2022-4981 | Low | 3.3 | 2025-10-21 | A vulnerability was detected in DCMTK up to 3.6.7. The impacted element is the function DcmQueryRetrieveConfig::readPeerList of the file /dcmqrcnf.cc of the co… |
CVE-2020-36855 | Medium | 5.3 | 2025-10-21 | A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of… |
CVE-2025-9732 | Medium | 5.3 | 2025-08-31 | A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the componen… |
CVE-2025-2357 | Medium | 6.3 | 2025-03-17 | A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. T… |
CVE-2025-25475 | High | 7.5 | 2025-02-18 | A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DICOM fi… |
CVE-2025-25474 | Medium | 6.5 | 2025-02-18 | DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h. |
CVE-2025-25472 | Medium | 5.3 | 2025-02-18 | A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file. |
CVE-2024-52333 | High | 8.4 | 2025-01-13 | An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to a… |
CVE-2024-47796 | High | 8.4 | 2025-01-13 | An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-o… |
CVE-2024-27628 | High | 8.1 | 2024-06-28 | Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component. |
CVE-2024-34509 | Medium | 5.3 | 2024-05-05 | dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. |
CVE-2024-34508 | Medium | 4.3 | 2024-05-05 | dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. |
CVE-2024-28130 | High | 7.5 | 2024-04-23 | An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malform… |
CVE-2022-43272 | High | 7.5 | 2022-12-02 | DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object. |
CVE-2021-41690 | High | 7.5 | 2022-06-28 | DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are no… |
CVE-2021-41689 | High | 7.5 | 2022-06-28 | DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result eve… |
CVE-2021-41688 | High | 7.5 | 2022-06-28 | DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific… |
CVE-2021-41687 | High | 7.5 | 2022-06-28 | DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sendin… |
CVE-2022-2121 | High | 7.5 | 2022-06-24 | OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a denial-of-service… |
CVE-2022-2120 | High | 7.5 | 2022-06-24 | OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into a… |
CVE-2022-2119 | High | 7.5 | 2022-06-24 | OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitr… |
CVE-2019-1010228 | Critical | 9.8 | 2019-07-22 | OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRL… |
CVE-2013-6825 | | | 2014-06-10 | (1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/ap… |