Description
A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OFFIS | DCMTK | 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | dcmtk | 3.7.0+really3.7.0-3 | — |
| Debian 13 | dcmtk | 3.6.9-5+deb13u1 | — |
| Debian 12 | dcmtk | 3.6.7-9~deb12u4 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | dcmtk | No fix yet | — |
| Ubuntu 26.04 LTS | dcmtk | No fix yet | — |
| Ubuntu 25.10 | dcmtk | No fix yet | — |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | dcmtk | No fix yet | — |
| Ubuntu Pro 22.04 LTS | dcmtk | No fix yet | — |
| Ubuntu Pro 20.04 LTS | dcmtk | No fix yet | — |
| Ubuntu Pro 18.04 LTS | dcmtk | No fix yet | — |
| Ubuntu Pro 16.04 LTS | dcmtk | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | dcmtk | 3.7.0-2.1 | openSUSE-SU-2026:10502-1 |
Advisories 1
- openSUSE-SU-2026:10502-1 dcmtk-3.7.0-2.1 on GA media SUSE / openSUSE Security Updates · Apr 9, 2026
References
- VDB-355486 | OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection vdb-entry technical-description
- VDB-355486 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- Submit #786061 | OFFIS DCMTK up to 3.7.0 OS Command Injection third-party-advisory
- https://machinespirits.com/advisory/2e1627/ related
- https://support.dcmtk.org/redmine/issues/1194 issue-tracking
- https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8 patch