VDB
CVE-2025-2357
CVE-2025-2357
PUBLISHED
CVSS 7.5 HIGH
A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.
EPSS 0.44% · 35.7th percentile
Risk Scores
CVSS 2.0
7.5
EPSS Score
0.44%
35.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| offis | dcmtk | 3.6.9 |
| n/a | DCMTK | 3.6.9 |
Timeline
- Mar 17, 2025 CVE Published
- Mar 17, 2025 EPSS Score
- Mar 17, 2025 PoC Published
- Mar 19, 2025 Coalition ESS Score
- Mar 31, 2025 EPSS Score
- Apr 14, 2025 EPSS Score
- Apr 28, 2025 EPSS Score
- May 12, 2025 EPSS Score
- May 26, 2025 EPSS Score
- Jun 9, 2025 EPSS Score
- Jun 23, 2025 EPSS Score
- Jun 23, 2025 Coalition ESS Score
References
- VDB-299824 | DCMTK dcmjpls JPEG-LS Decoder memory corruption vdb
- VDB-299824 | CTI Indicators (IOB, IOC) url
- Submit #513692 | DCMTK v3.6.9+DEV segmentation fault third-party-advisory
- https://support.dcmtk.org/redmine/issues/1155 exploit
- https://support.dcmtk.org/redmine/issues/1155?tab=history#note-1 issue
- https://nvd.nist.gov/vuln/detail/CVE-2025-2357 advisory
- https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html advisory