CVE-2025-14607
Medium · 6.3CVSS
6.3
EPSS
0.3%
Published
Dec 13, 2025
CISA due date
—
The record
A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | dcmtk | 0 | 3.6.7-4.7.mga9 |
| openSUSE:Tumbleweed | dcmtk | 0 | 3.7.0-1.1 |
Related vulnerabilities
- CVE-2025-14841 A flaw has been found in OFFIS DCMTK up to 3.6.9. Also affects dcmtk
- CVE-2024-52333 An improper array index validation vulnerability exists in the determineMinMax… Also affects dcmtk
- CVE-2024-47796 An improper array index validation vulnerability exists in the nowindow functionality of… Also affects dcmtk
- CVE-2024-28130 An incorrect type conversion vulnerability exists in the… Also affects dcmtk
- CVE-2026-5663 A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. Also affects dcmtk
- CVE-2026-112108 A vulnerability was determined in ztxz16 fastllm up to 0.1.8.2. CWE-119
- CVE-2026-112073 A vulnerability was identified in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dc… CWE-119
- CVE-2026-90831 A vulnerability was detected in GNU Binutils 2.47. CWE-119