CVE-2025-9732

MEDIUM

DCMTK < 3.6.9 - Memory Corruption in dcm2img Component

Title source: llm

Description

A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the component dcm2img. Such manipulation leads to memory corruption. Local access is required to approach this attack. The name of the patch is 7ad81d69b. It is best practice to apply a patch to resolve this issue.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry

https://vuldb.com/?id.322023

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.322023

Third Party Advisory, VDB Entry third-party-advisory

https://vuldb.com/?submit.639772

Patch patch

https://github.com/DCMTK/dcmtk/commit/7ad81d69b

View Patch ZIP pw:eip

Scores

CVSS v3 5.3

EPSS 0.0016

EPSS Percentile 5.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-119 CWE-787

Status published

Products (1)

offis/dcmtk < 3.6.9

Published Aug 31, 2025

Tracked Since Feb 18, 2026