Description
A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of the argument StorageQuota leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 3.6.6 is sufficient to fix this issue. The identifier of the patch is 0fef9f02e. It is recommended to upgrade the affected component.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | DCMTK | 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5 | 3.6.6 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dcmtk | 3.6.6-1 | — |
| Debian 13 | dcmtk | 3.6.6-1 | — |
| Debian 12 | dcmtk | 3.6.6-1 | — |
| Debian 11 | dcmtk | 3.6.5-1+deb11u5 | DLA-4363-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | dcmtk | No fix yet | — |
| Ubuntu Pro 18.04 LTS | dcmtk | No fix yet | — |
| Ubuntu Pro 16.04 LTS | dcmtk | No fix yet | — |
Advisories 1
- DLA-4363-1 dcmtk - security update Debian Security (DSA / DLA) · Nov 3, 2025
References
- VDB-329028 | DCMTK dcmqrscp parseQuota stack-based overflow vdb-entry technical-description
- VDB-329028 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #673137 | DCMTK GitHub Repository DCMTK 3.6.5 Stack-based Buffer Overflow third-party-advisory
- https://shimo.im/docs/rp3OMVMDPKtjn0km/ exploit