CVE-2026-5663
HIGHOFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection
Title source: cnaDescription
A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.
References (6)
Core 6
Core References
Vdb Entry, Technical Description vdb-entry
technical-description
VDB-355486 | OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection
https://vuldb.com/vuln/355486
Signature, Permissions Required signature
permissions-required
VDB-355486 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/355486/cti
Third Party Advisory third-party-advisory
Submit #786061 | OFFIS DCMTK up to 3.7.0 OS Command Injection
https://vuldb.com/submit/786061
Related related
https://machinespirits.com/advisory/2e1627/
Issue Tracking issue-tracking
https://support.dcmtk.org/redmine/issues/1194
Scores
CVSS v3
7.3
EPSS
0.0172
EPSS Percentile
74.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-77
CWE-78
Status
published
Products (9)
offis/dcmtk
< 3.7.0
OFFIS/DCMTK
3.0
OFFIS/DCMTK
3.1
OFFIS/DCMTK
3.2
OFFIS/DCMTK
3.3
OFFIS/DCMTK
3.4
OFFIS/DCMTK
3.5
OFFIS/DCMTK
3.6
OFFIS/DCMTK
3.7.0
Published
Apr 06, 2026
Tracked Since
Apr 06, 2026