CVE-2025-14841
Low · 3.3CVSS
3.3
EPSS
0.1%
Published
Dec 18, 2025
CISA due date
—
The record
A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest in the library dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. This manipulation causes null pointer dereference. The attack requires local access. Upgrading to version 3.7.0 is sufficient to resolve this issue. Patch name: ffb1a4a37d2c876e3feeb31df4930f2aed7fa030. You should upgrade the affected component.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Mageia:9 | dcmtk | 0 | 3.6.7-4.7.mga9 |
| openSUSE:Tumbleweed | dcmtk | 0 | 3.7.0-1.1 |
Related vulnerabilities
- CVE-2025-14607 A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Also affects dcmtk
- CVE-2024-52333 An improper array index validation vulnerability exists in the determineMinMax… Also affects dcmtk
- CVE-2024-47796 An improper array index validation vulnerability exists in the nowindow functionality of… Also affects dcmtk
- CVE-2024-28130 An incorrect type conversion vulnerability exists in the… Also affects dcmtk
- CVE-2026-5663 A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. Also affects dcmtk
- CVE-2026-109277 ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script… CWE-404
- CVE-2026-93312 A flaw has been found in Freedesktop Poppler 26.07.0. CWE-404
- CVE-2026-91781 A security vulnerability has been detected in GNU Binutils 2.47. CWE-404