cbcvebase.
CVE-2026-5663
published 2026-04-06

CVE-2026-5663: A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file…

PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
1.72%
74.6th percentile
A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

Affected

10 ranges
VendorProductVersion rangeFixed in
debiandcmtk
offisdcmtk<= 3.7.0
offisdcmtk
offisdcmtk
offisdcmtk
offisdcmtk
offisdcmtk
offisdcmtk
offisdcmtk
offisdcmtk

Detection & IOCsextracted from sources · hover to see the quote

hashedbb085e45788dccaf0e64d71534cfca925784b8
  • Monitor for OS command injection attempts via crafted DICOM C-STORE requests targeting the storescp component, specifically the executeOnReception/executeOnEndOfStudy functions in dcmnet/apps/storescp.cc
  • Inspect inbound DICOM C-STORE requests for malicious payloads that could trigger OS command injection via storescp reception/end-of-study hooks
  • ·Vulnerability affects OFFIS DCMTK up to version 3.7.0; no fix available as of Apr 06, 2026 for affected Linux Debian and Red Hat platforms
  • ·Remote exploitation is possible, meaning storescp instances exposed to untrusted networks are at elevated risk

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv6.9MEDIUM
vendor_debian6.9MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.