CVE catalog
CVE-2025-14607
dcmtk: CVE-2025-14607
- Severity
- Medium · CVSS 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.27% · Oct 25, 2026
A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | dcmtk | sid | 3.7.0+really3.7.0-7 | fixed |
| Debian | dcmtk | forky | 3.7.0+really3.7.0-7 | fixed |
| Debian | dcmtk | trixie | 3.6.9-5+deb13u3 | fixed |
| Debian | dcmtk | bookworm | 3.6.7-9~deb12u4 | fixed |
| Opensuse | dcmtk | tumbleweed | 3.7.0-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | dcmtk | source | sid | 3.7.0+really3.7.0-1 | not yet assigned | Not reported | [1122926] |
| Debian | dcmtk | source | forky | 3.7.0+really3.7.0-1 | not yet assigned | Not reported | [1122926] |
| Debian | dcmtk | source | trixie | 3.6.9-5+deb13u1 | not yet assigned | Not reported | [1122926] |
| Debian | dcmtk | source | bookworm | 3.6.7-9~deb12u4 | not yet assigned | Not reported | [1122926] |
| Opensuse | dcmtk | rpm | tumbleweed | 3.7.0-1.1 | Not reported | OPENSUSE-SU-2026:10006-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [dcmtk-devel]Unknown
Source package: [dcmtk]
Details (1)
3.7.0-2.4· x86_64 · tumbleweedUnknown · Fixed:
3.7.0-1.1Version impact unknown
dsa · dcmtk · opensuse · tumbleweed
- [libdcmtk20]Unknown
Source package: [dcmtk]
Details (1)
3.7.0-2.4· x86_64 · tumbleweedUnknown · Fixed:
3.7.0-1.1Version impact unknown
dsa · dcmtk · opensuse · tumbleweed
- [dcmtk]Fixed
Source package: [dcmtk]
Details (1)
3.7.0-2.4· x86_64 · tumbleweedFixed · Fixed:
3.7.0-1.1dsa · dcmtk · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [dcmtk]Fixed
Details (2)
3.6.7-9~deb12u4· amd64 · bookwormFixed · Fixed:
3.6.7-9~deb12u4dsa · dcmtk · debian · bookworm; dsa · dcmtk · debian · 12
3.6.7-9~deb12u4· arm64 · bookwormFixed · Fixed:
3.6.7-9~deb12u4dsa · dcmtk · debian · bookworm; dsa · dcmtk · debian · 12
- [dcmtk-doc]Fixed
Source package: [dcmtk]
Details (2)
3.6.7-9~deb12u4· all · bookwormFixed · Fixed:
3.6.7-9~deb12u4dsa · dcmtk · debian · bookworm; dsa · dcmtk · debian · 12
3.6.7-9~deb12u4· all · bookwormFixed · Fixed:
3.6.7-9~deb12u4dsa · dcmtk · debian · bookworm; dsa · dcmtk · debian · 12
- [libdcmtk17]Fixed
Source package: [dcmtk]
Details (2)
3.6.7-9~deb12u4· amd64 · bookwormFixed · Fixed:
3.6.7-9~deb12u4dsa · dcmtk · debian · bookworm; dsa · dcmtk · debian · 12
3.6.7-9~deb12u4· arm64 · bookwormFixed · Fixed:
3.6.7-9~deb12u4dsa · dcmtk · debian · bookworm; dsa · dcmtk · debian · 12
- [libdcmtk-dev]Fixed
Source package: [dcmtk]
Details (2)
3.6.7-9~deb12u4· amd64 · bookwormFixed · Fixed:
3.6.7-9~deb12u4dsa · dcmtk · debian · bookworm; dsa · dcmtk · debian · 12
3.6.7-9~deb12u4· arm64 · bookwormFixed · Fixed:
3.6.7-9~deb12u4dsa · dcmtk · debian · bookworm; dsa · dcmtk · debian · 12
[Debian 13 (Trixie)]
- [dcmtk]Fixed
Details (2)
3.6.9-5+deb13u2· amd64 · trixieFixed · Fixed:
3.6.9-5+deb13u1dsa · dcmtk · debian · 13
3.6.9-5+deb13u2· arm64 · trixieFixed · Fixed:
3.6.9-5+deb13u1dsa · dcmtk · debian · 13
- [dcmtk-data]Fixed
Source package: [dcmtk]
Details (2)
3.6.9-5+deb13u2· all · trixieFixed · Fixed:
3.6.9-5+deb13u1dsa · dcmtk · debian · 13
3.6.9-5+deb13u2· all · trixieFixed · Fixed:
3.6.9-5+deb13u1dsa · dcmtk · debian · 13
- [dcmtk-doc]Fixed
Source package: [dcmtk]
Details (2)
3.6.9-5+deb13u2· all · trixieFixed · Fixed:
3.6.9-5+deb13u1dsa · dcmtk · debian · 13
3.6.9-5+deb13u2· all · trixieFixed · Fixed:
3.6.9-5+deb13u1dsa · dcmtk · debian · 13
- [libdcmtk19]Fixed
Source package: [dcmtk]
Details (2)
3.6.9-5+deb13u2· amd64 · trixieFixed · Fixed:
3.6.9-5+deb13u1dsa · dcmtk · debian · 13
3.6.9-5+deb13u2· arm64 · trixieFixed · Fixed:
3.6.9-5+deb13u1dsa · dcmtk · debian · 13
- [libdcmtk-dev]Fixed
Source package: [dcmtk]
Details (2)
3.6.9-5+deb13u2· amd64 · trixieFixed · Fixed:
3.6.9-5+deb13u1dsa · dcmtk · debian · 13
3.6.9-5+deb13u2· arm64 · trixieFixed · Fixed:
3.6.9-5+deb13u1dsa · dcmtk · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10006-1.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2025-14607]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2025-14607]
- [https://osv.dev/vulnerability/DLA-4443-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10006-1]
- [https://security-tracker.debian.org/tracker/CVE-2025-14607]
[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]