PT-2026-30606 · Offis · Dcmtk

Simon Weber + 2 · Published 2026-04-06 · Updated 2026-04-27 · CVE-2026-5663

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OFFIS DCMTK versions up to 3.7.0

Description A security flaw exists in OFFIS DCMTK up to version 3.7.0. The issue affects the executeOnReception/executeOnEndOfStudy function within the dcmnet/apps/storescp.cc file of the storescp component. Manipulation of this function can lead to OS command injection. Remote exploitation is possible.

Recommendations Apply patch edbb085e45788dccaf0e64d71534cfca925784b8.

Fix

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2026-5663

OPENSUSE-SU-2026:10502-1

Affected Products

Dcmtk

References · 17

• https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-5663 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-5663 · Security Note
• https://ubuntu.com/security/CVE-2026-5663 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10502-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-5663 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-5663 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-5663 · Security Note
• https://t.me/cveNotify/161138 · Telegram Post
• https://vuldb.com/vuln/355486 · Note
• https://support.dcmtk.org/redmine/issues/1194 · Note
• https://twitter.com/CVEnew/status/2041171324823834642 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041173135853019566 · Twitter Post
• https://machinespirits.com/advisory/2e1627 · Note
• https://vuldb.com/vuln/355486/cti · Note