CVE-2025-14607Medium· 6.3▾ Sunlit

A vulnerability was detected in OFFIS DCMTK up to 3.6.9

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score35/ 100 · Low

impact 34.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Dec 13, 2025

Updated

Oct 7, 2026

CVSS

6.3

Vendor

—

Product

—

CWE

CWE-119

Depth score

35 · Low

EPSS

0.27% · p18

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 298 days

Dec 13, 2025Published
Disclosed via NVD
Oct 7, 2026Record revised
Last analysed / modified upstream
Oct 7, 2026EPSS first tracked
0.3%

CWE-119 #nvd

Full technical detail▾

Overview

A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed