CVE-2024-34508 — NULL Pointer Dereference in Dcmtk

CWE-476 — NULL Pointer Dereference8 documents5 sources
Severity
4.3MEDIUMNVD
OSV7.5
EPSS
0.1%
top 78.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Offis DcmtkDebian DcmtkDebian Linux
Timeline
PublishedMay 5
Latest updateJul 8

Description

dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:LExploitability: 2.8 | Impact: 1.4

Affected Packages4 packages

▶NVDoffis/dcmtk< 3.6.9
▶debiandebian/dcmtk< dcmtk 3.6.7-9~deb12u2 (bookworm)
▶Debianoffis/dcmtk< 3.6.5-1+deb11u1+3
▶Ubuntuoffis/dcmtk< 3.6.4-2.1ubuntu0.1+7

Also affects: Debian Linux 10.0

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
dcmtk regression↗2025-07-08
▶
OSV
dcmtk vulnerabilities↗2024-09-17
▶
OSV
CVE-2024-34508: dcmnet in DCMTK before 3↗2024-05-05
▶
GHSA
GHSA-f5q9-9qmh-w24h: dcmnet in DCMTK before 3↗2024-05-05
▶

📋Vendor Advisories

3
Ubuntu
DCMTK regression↗2025-07-08
▶
Ubuntu
DCMTK vulnerabilities↗2024-09-17
▶
Debian
CVE-2024-34508: dcmtk - dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE messa...↗2024
▶
CVE-2024-34508 — NULL Pointer Dereference in Dcmtk | cvebase