PT-2026-30606 · Offis · Dcmtk

Simon Weber + 2 · Published 2026-04-06 · Updated 2026-04-06 · CVE-2026-5663

NVD

CVSS v2.0

7.5

High

AV:N/AC:L/Au:N/C:P/I:P/A:P

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2026-5663

Affected Products

Dcmtk

References · 9

• https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-5663 · Security Note
• https://vuldb.com/submit/786061 · Note
• https://vuldb.com/vuln/355486 · Note
• https://vuldb.com/vuln/355486/cti · Note
• https://support.dcmtk.org/redmine/issues/1194 · Note
• https://twitter.com/infoflowcloud/status/2041173135853019566 · Twitter Post
• https://machinespirits.com/advisory/2e1627 · Note
• https://twitter.com/CVEnew/status/2041171324823834642 · Twitter Post