VDB
CVE-2025-2357
CVE-2025-2357
PUBLISHED
CVSS 5.300000190734863 MEDIUM
A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.
EPSS 0.17% · 37.7th percentile
Risk Scores
CVSS 4.0
5.300000190734863
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS Score
0.17%
37.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| offis | dcmtk | 3.6.9 |
| n/a | DCMTK | 3.6.9 |
Timeline
- Mar 17, 2025 EPSS Score
- Mar 17, 2025 CVE Published
- Mar 17, 2025 PoC Published
- Mar 19, 2025 Coalition ESS Score
- Mar 30, 2025 EPSS Score
- Apr 13, 2025 EPSS Score
- Apr 26, 2025 EPSS Score
- May 10, 2025 EPSS Score
- May 23, 2025 EPSS Score
- Jun 5, 2025 EPSS Score
- Jun 19, 2025 EPSS Score
- Jun 23, 2025 Coalition ESS Score
References
- VDB-299824 | DCMTK dcmjpls JPEG-LS Decoder memory corruption vdb
- VDB-299824 | CTI Indicators (IOB, IOC) url
- Submit #513692 | DCMTK v3.6.9+DEV segmentation fault third-party-advisory
- https://support.dcmtk.org/redmine/issues/1155 exploit
- https://support.dcmtk.org/redmine/issues/1155?tab=history#note-1 issue
- https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html url
- https://nvd.nist.gov/vuln/detail/CVE-2025-2357 advisory