PT-2025-42893 · Dcmtk+1 · Dcmtk+1

Zh_Vul · Published 2025-10-21 · Updated 2025-11-03 · CVE-2022-4981

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions DCMTK versions up to 3.6.7

Description A flaw exists in DCMTK where manipulation of the DcmQueryRetrieveConfig::readPeerList function within the /dcmqrcnf.cc file of the dcmqrscp component can lead to a null pointer dereference. This issue requires local access to exploit. The exploit is publicly available.

Recommendations Upgrade to version 3.6.8 to resolve this issue.

Exploit

Fix

Improper Resource Release

NULL Pointer Dereference

Weakness Enumeration

CWE-404

CWE-476

Related Identifiers

BDU:2025-16066

CVE-2022-4981

DLA-4363-1

Affected Products

Dcmtk

Debian

References · 21

• 🔥 https://shimo.im/docs/e1Azd4dDQXUgOGqW · Exploit
• 🔥 https://shimo.im/docs/e1Azd4dDQXUgOGqW/read · Exploit
• https://cve.org/CVERecord?id=CVE-2022-4981 · Security Note
• https://osv.dev/vulnerability/DLA-4363-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4981 · Security Note
• https://support.dcmtk.org/redmine/issues/1026 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-4981 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE47 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-4981 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-4981 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-16066 · Security Note
• https://osv.dev/vulnerability/CVE-2022-4981 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-4981 · Vendor Advisory