CVE-2025-14607CWE-119

CVE-2025-14607

Medium · published December 13, 2025

CVSS v3.1
6.3
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.

The record
Technical detail
CVSS v3.1
6.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00274 · 18.7th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2025-12-13T21:16Z
References (7)
https://github.com/DCMTK/dcmtk/commit/4c0e5c10079392c594d6a7abd95dd78ac0aa556a · [email protected]https://support.dcmtk.org/redmine/issues/1184 · [email protected]https://support.dcmtk.org/redmine/projects/dcmtk/activity?from=2025-12-02 · [email protected]https://support.dcmtk.org/redmine/versions/19 · [email protected]https://vuldb.com/?ctiid.336283 · [email protected]https://vuldb.com/?id.336283 · [email protected]https://vuldb.com/?submit.705036 · [email protected]
EPSS history
Timeline
  • 13 DEC 13:02Z
    OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption
    cvelistv5