CVE-2026-5663 Details
Description
A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.
A command injection vulnerability has been identified in OFFIS DCMTK versions prior to 3.7.0, specifically within the storescp application. The issue arises in the 'executeOnReception' and 'executeOnEndOfStudy' functions, where user-controlled input is inadequately sanitized before being passed to the shell. This flaw enables remote code execution by exploiting DICOM C-STORE requests.
Users are advised to update to the latest version of OFFIS DCMTK, where this vulnerability has been patched. The patch can be applied by downloading the updated version from the official DCMTK GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8 | [email protected] | Patch |
| https://machinespirits.com/advisory/2e1627/ | [email protected] | MitigationThird Party Advisory |
| https://support.dcmtk.org/redmine/issues/1194 | [email protected] | Issue TrackingThird Party Advisory |
| https://vuldb.com/submit/786061 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/355486 | [email protected] | Third Party AdvisoryVDB Entry |
| https://vuldb.com/vuln/355486/cti | [email protected] | Permissions RequiredVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| offis dcmtk | <= 3.7.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |