CVE-2022-43272 — Missing Release of Memory after Effective Lifetime in Dcmtk

CWE-401 — Missing Release of Memory after Effective Lifetime10 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 65.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Offis DcmtkDebian Dcmtk
Timeline
PublishedDec 2
Latest updateJul 8

Description

DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/dcmtk< dcmtk 3.6.7-8 (bookworm)
▶Debianoffis/dcmtk< 3.6.5-1+deb11u1+3
▶Ubuntuoffis/dcmtk< 3.6.4-2.1ubuntu0.1+11
▶NVDoffis/dcmtk3.6.7

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
dcmtk regression↗2025-07-08
▶
OSV
dcmtk vulnerabilities↗2024-09-17
▶
OSV
dcmtk vulnerabilities↗2023-02-22
▶
OSV
CVE-2022-43272: DCMTK v3↗2022-12-02
▶
GHSA
GHSA-h5pv-v4mg-79m7: DCMTK v3↗2022-12-02
▶

📋Vendor Advisories

4
Ubuntu
DCMTK regression↗2025-07-08
▶
Ubuntu
DCMTK vulnerabilities↗2024-09-17
▶
Ubuntu
DCMTK vulnerabilities↗2023-02-22
▶
Debian
CVE-2022-43272: dcmtk - DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association o...↗2022
▶
CVE-2022-43272 — Debian Dcmtk vulnerability | cvebase