CVE-2022-4981CWE-404CWE-476

DCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereference

Medium · published October 21, 2025

CVSS v4.0
4.8
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

A vulnerability was detected in DCMTK up to 3.6.7. The impacted element is the function DcmQueryRetrieveConfig::readPeerList of the file /dcmqrcnf.cc of the component dcmqrscp. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit is now public and may be used. Upgrading to version 3.6.8 is sufficient to resolve this issue. The patch is identified as 957fb31e5. Upgrading the affected component is advised.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00275 · 18.9th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2025-10-21T15:02Z
EPSS history
Timeline
  • 21 OCT 15:02Z
    DCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereference
    cvelistv5