CVE-2025-14607

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14607", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2025-12-12T19:54:18.039Z", "datePublished": "2025-12-13T13:02:07.302Z", "dateUpdated": "2026-02-24T05:49:06.961Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-24T05:49:06.961Z"}, "title": "OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-119", "lang": "en", "description": "Memory Corruption"}]}], "affected": [{"vendor": "OFFIS", "product": "DCMTK", "versions": [{"version": "3.6.0", "status": "affected"}, {"version": "3.6.1", "status": "affected"}, {"version": "3.6.2", "status": "affected"}, {"version": "3.6.3", "status": "affected"}, {"version": "3.6.4", "status": "affected"}, {"version": "3.6.5", "status": "affected"}, {"version": "3.6.6", "status": "affected"}, {"version": "3.6.7", "status": "affected"}, {"version": "3.6.8", "status": "affected"}, {"version": "3.6.9", "status": "affected"}, {"version": "3.7.0", "status": "unaffected"}], "cpes": ["cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:*"], "modules": ["dcmdata"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "timeline": [{"time": "2025-12-12T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2025-12-12T01:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2025-12-15T06:54:43.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "KendrickZou (VulDB User)", "type": "reporter"}], "references": [{"url": "https://vuldb.com/?id.336283", "name": "VDB-336283 | OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.336283", "name": "VDB-336283 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.705036", "name": "Submit #705036 | OFFIS DCMTK 3.6.9 Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://support.dcmtk.org/redmine/issues/1184", "tags": ["issue-tracking"]}, {"url": "https://support.dcmtk.org/redmine/projects/dcmtk/activity?from=2025-12-02", "tags": ["related"]}, {"url": "https://github.com/DCMTK/dcmtk/commit/4c0e5c10079392c594d6a7abd95dd78ac0aa556a", "tags": ["patch"]}, {"url": "https://support.dcmtk.org/redmine/versions/19", "tags": ["patch"]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T21:46:27.176391Z", "id": "CVE-2025-14607", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T21:46:37.964Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14607", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T21:46:27.176391Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T21:46:33.166Z"}}], "cna": {"tags": ["x_open-source"], "title": "OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption", "credits": [{"lang": "en", "type": "reporter", "value": "KendrickZou (VulDB User)"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P/E:ND/RL:OF/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:*"], "vendor": "OFFIS", "modules": ["dcmdata"], "product": "DCMTK", "versions": [{"status": "affected", "version": "3.6.0"}, {"status": "affected", "version": "3.6.1"}, {"status": "affected", "version": "3.6.2"}, {"status": "affected", "version": "3.6.3"}, {"status": "affected", "version": "3.6.4"}, {"status": "affected", "version": "3.6.5"}, {"status": "affected", "version": "3.6.6"}, {"status": "affected", "version": "3.6.7"}, {"status": "affected", "version": "3.6.8"}, {"status": "affected", "version": "3.6.9"}, {"status": "unaffected", "version": "3.7.0"}]}], "timeline": [{"lang": "en", "time": "2025-12-12T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2025-12-12T01:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2025-12-15T06:54:43.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/?id.336283", "name": "VDB-336283 | OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/?ctiid.336283", "name": "VDB-336283 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/?submit.705036", "name": "Submit #705036 | OFFIS DCMTK 3.6.9 Buffer Overflow", "tags": ["third-party-advisory"]}, {"url": "https://support.dcmtk.org/redmine/issues/1184", "tags": ["issue-tracking"]}, {"url": "https://support.dcmtk.org/redmine/projects/dcmtk/activity?from=2025-12-02", "tags": ["related"]}, {"url": "https://github.com/DCMTK/dcmtk/commit/4c0e5c10079392c594d6a7abd95dd78ac0aa556a", "tags": ["patch"]}, {"url": "https://support.dcmtk.org/redmine/versions/19", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "Memory Corruption"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-02-24T05:49:06.961Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14607", "state": "PUBLISHED", "dateUpdated": "2026-02-24T05:49:06.961Z", "dateReserved": "2025-12-12T19:54:18.039Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2025-12-13T13:02:07.302Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:*"], "modules": ["dcmdata"], "product": "DCMTK", "vendor": "OFFIS", "versions": [{"status": "affected", "version": "3.6.0"}, {"status": "affected", "version": "3.6.1"}, {"status": "affected", "version": "3.6.2"}, {"status": "affected", "version": "3.6.3"}, {"status": "affected", "version": "3.6.4"}, {"status": "affected", "version": "3.6.5"}, {"status": "affected", "version": "3.6.6"}, {"status": "affected", "version": "3.6.7"}, {"status": "affected", "version": "3.6.8"}, {"status": "affected", "version": "3.6.9"}, {"status": "unaffected", "version": "3.7.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component."}, {"lang": "es", "value": "Se detect\u00f3 una vulnerabilidad en OFFIS DCMTK hasta 3.6.9. Afectada por este problema es la funci\u00f3n DcmByteString::makeDicomByteString del archivo dcmdata/libsrc/dcbytstr.cc del componente dcmdata. La manipulaci\u00f3n resulta en corrupci\u00f3n de memoria. El ataque puede lanzarse remotamente. La actualizaci\u00f3n a la versi\u00f3n 3.7.0 puede resolver este problema. El parche se identifica como 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. Deber\u00eda actualizar el componente afectado."}], "id": "CVE-2025-14607", "lastModified": "2026-10-07T19:10:00.160", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14607", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T21:46:27.176391Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:52.840", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/DCMTK/dcmtk/commit/4c0e5c10079392c594d6a7abd95dd78ac0aa556a"}, {"source": "cna@vuldb.com", "url": "https://support.dcmtk.org/redmine/issues/1184"}, {"source": "cna@vuldb.com", "url": "https://support.dcmtk.org/redmine/projects/dcmtk/activity?from=2025-12-02"}, {"source": "cna@vuldb.com", "url": "https://support.dcmtk.org/redmine/versions/19"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?ctiid.336283"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?id.336283"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/?submit.705036"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{"bugzilla": {"description": "dcmtk: OFFIS DCMTK: Remote memory corruption vulnerability", "id": "2421979", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2421979"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "status": "draft"}, "cwe": "CWE-119", "details": ["A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.", "A flaw was found in OFFIS DCMTK (Digital Imaging and Communications in Medicine Toolkit). This vulnerability allows memory corruption via a remote attack."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2025-14607", "public_date": "2025-12-13T13:02:07Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-14607\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-14607\nhttps://github.com/DCMTK/dcmtk/commit/4c0e5c10079392c594d6a7abd95dd78ac0aa556a\nhttps://support.dcmtk.org/redmine/issues/1184\nhttps://support.dcmtk.org/redmine/projects/dcmtk/activity?from=2025-12-02\nhttps://support.dcmtk.org/redmine/versions/19\nhttps://vuldb.com/?ctiid.336283\nhttps://vuldb.com/?id.336283\nhttps://vuldb.com/?submit.705036"], "statement": "This vulnerability is rated Moderate for Red Hat products. A memory corruption flaw exists in the `DcmByteString::makeDicomByteString` function of the `dcmdata` component in OFFIS DCMTK. This issue can be exploited remotely when processing specially crafted DICOM data, potentially leading to information disclosure, data integrity issues, or denial of service.", "threat_severity": "Moderate"}

{"created": "2025-12-14T21:14:25.461246+00:00", "updated": "2025-12-14T21:14:25.461272+00:00", "vendors": ["offis", "offis$PRODUCT$dcmtk"]}