PT-2025-51987 · Offis+1 · Dcmtk+1

Kendrickzou · Published 2025-12-18 · Updated 2026-02-16 · CVE-2025-14841

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions OFFIS DCMTK versions up to 3.6.9

Description A flaw exists in the DCMTK library, specifically within the DcmQueryRetrieveIndexDatabaseHandle::startFindRequest and DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest functions located in the dcmqrdb/libsrc/dcmqrdbi.cc file of the dcmqrscp component. This manipulation can lead to a null pointer dereference. Local access is required for exploitation.

Recommendations Upgrade to version 3.7.0 to resolve this issue.

Fix

NULL Pointer Dereference

Improper Resource Release

Weakness Enumeration

CWE-476

CWE-404

Related Identifiers

BDU:2026-07521

CVE-2025-14841

MGASA-2026-0040

OPENSUSE-SU-2026:10006-1

Affected Products

Dcmtk

Debian

References · 27

• https://github.com/DCMTK/dcmtk/commit/ffb1a4a37d2c876e3feeb31df4930f2aed7fa030 · Patch
• https://github.com/DCMTK/dcmtk/releases/tag/DCMTK-3.7.0 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-14841 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10006-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-14841 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-14841 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-14841 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2026-0040 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-14841 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14841 · Security Note
• https://ubuntu.com/security/CVE-2025-14841 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2026-0040.html · Security Note
• https://bdu.fstec.ru/vul/2026-07521 · Security Note
• https://twitter.com/CVEnew/status/2002487740865392882 · Twitter Post