Log in Start free

Vulnerability · Published Dec 13, 2025 · Assigned by VulDB

CVE-2025-14607OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption

Medium 6.3

In plain English

A medium-severity memory corruption in DCMTK from OFFIS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 80.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12dcmtk3.6.7-9~deb12u4DEBIAN-CVE-2025-14607
Debian:13dcmtk3.6.9-5+deb13u1DEBIAN-CVE-2025-14607
Debian:14dcmtk3.7.0+really3.7.0-1DEBIAN-CVE-2025-14607
Ubuntu:25.10dcmtkno fix listedUBUNTU-CVE-2025-14607
Ubuntu:26.04:LTSdcmtkno fix listedUBUNTU-CVE-2025-14607
Ubuntu:26.10dcmtkno fix listedUBUNTU-CVE-2025-14607

Affected products (as reported)

VendorProductVersions
OFFIS DCMTK 3.6.03.6.13.6.23.6.33.6.43.6.53.6.63.6.7

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References