Log in Start free

Vulnerability · Published Apr 6, 2026 · Assigned by VulDB

CVE-2026-5663OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection

High 7.3

In plain English

A high-severity OS command injection in DCMTK from OFFIS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 80% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.3High
Exploit odds (30 days)2.0%top 19.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12dcmtk3.6.7-9~deb12u4DEBIAN-CVE-2026-5663
Debian:13dcmtk3.6.9-5+deb13u1DEBIAN-CVE-2026-5663
Debian:14dcmtk3.7.0+really3.7.0-3DEBIAN-CVE-2026-5663
Ubuntu:25.10dcmtkno fix listedUBUNTU-CVE-2026-5663
Ubuntu:26.04:LTSdcmtkno fix listedUBUNTU-CVE-2026-5663
Ubuntu:26.10dcmtkno fix listedUBUNTU-CVE-2026-5663

Affected products (as reported)

VendorProductVersions
OFFIS DCMTK 3.03.13.23.33.43.53.63.7.0

Weakness: CWE-78, CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

References