VDB
CVE-2025-14607
CVE-2025-14607
PUBLISHED
CVSS 5.3 MEDIUM
Reported by VulDB · Published December 13, 2025
A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.
Risk Scores
CVSS 4.0
5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| OFFIS | DCMTK | 3.6.0, 3.6.1, 3.6.2 |
| OFFIS | DCMTK | 3.6.0, 3.6.1, 3.6.3 |
Timeline
- Dec 12, 2025 CVE ID Reserved
- Dec 13, 2025 CVE Published
- Dec 14, 2025 EPSS Score
- Dec 18, 2025 EPSS Score
- Dec 22, 2025 EPSS Score
- Dec 26, 2025 EPSS Score
- Dec 30, 2025 EPSS Score
- Jan 3, 2026 EPSS Score
- Jan 7, 2026 EPSS Score
- Jan 11, 2026 EPSS Score
- Jan 15, 2026 EPSS Score
- Jan 19, 2026 EPSS Score
References
- VDB-336283 | OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption vdb-entrytechnical-description
- VDB-336283 | CTI Indicators (IOB, IOC, IOA) signaturepermissions-required
- Submit #705036 | OFFIS DCMTK 3.6.9 Buffer Overflow third-party-advisory
- issue-tracking
- related
- patch
- patch