CVE-2025-9732CWE-119CWE-787

CVE-2025-9732

Medium · published August 31, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
6.8
In the wild
Unconfirmed
What it is

A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the component dcm2img. Such manipulation leads to memory corruption. Local access is required to approach this attack. The name of the patch is 7ad81d69b. It is best practice to apply a patch to resolve this issue.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.8th percentile
Weaknesses
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer; CWE-787 · Out-of-bounds Write
Published
2025-08-31T18:15Z
Affected products (1)
ProductVersionsFixed in
offis/dcmtk≤ 3.6.9—
References (5)
https://github.com/DCMTK/dcmtk/commit/7ad81d69b · [email protected]https://vuldb.com/?ctiid.322023 · [email protected]https://vuldb.com/?id.322023 · [email protected]https://vuldb.com/?submit.639772 · [email protected]https://github.com/DCMTK/dcmtk/commit/7ad81d69b · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 31 AUG 14:02Z
    DCMTK dcm2img diybrpxt.h memory corruption
    cvelistv5