Offis maintains DCMTK, a widely embedded open-source toolkit for medical imaging (DICOM) applications that, despite a narrow product scope, reaches a broad installed base across healthcare systems, research institutions, and commercial medical software. Vulnerabilities affecting this vendor skew strongly toward critical-severity outcomes and recur through memory-safety weakness classes including buffer overflows, out-of-bounds access, NULL-pointer dereferences, and memory-management flaws that are characteristic of C-language codebases handling complex binary protocols. The toolkit's deep integration into medical imaging pipelines means a single vulnerability can propagate across numerous downstream applications and clinical deployments, amplifying the defensive importance of tracking Offis disclosures despite the vendor's focused product portfolio. Defenders should prioritize patching this vendor's releases and inventory downstream medical and imaging products that depend on DCMTK; current severity, exploitation activity, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Offis over time
Signals from CVEs in this vendor scope (24 CVEs).
24 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-5663CRITICAL A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the componen | Apr 6, 2026 | 9.8 | 32 | NO | NO |
CVE-2019-1010228CRITICAL OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress( | Jul 22, 2019 | 9.8 | 32 | NO | NO |
CVE-2022-2120CRITICAL OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories | Jun 24, 2022 | 9.8 | 31 | NO | NO |
CVE-2022-2119CRITICAL OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under | Jun 24, 2022 | 9.8 | 30 | NO | NO |
CVE-2025-9732HIGH A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the component dcm2img. Such manip | Aug 31, 2025 | 7.8 | 26 | NO | NO |
CVE-2022-43272HIGH DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object. | Dec 2, 2022 | 7.5 | 25 | NO | NO |
CVE-2021-41690HIGH DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sen | Jun 28, 2022 | 7.5 | 25 | NO | NO |
CVE-2021-41689HIGH DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is nu | Jun 28, 2022 | 7.5 | 25 | NO | NO |
CVE-2021-41688HIGH DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqr | Jun 28, 2022 | 7.5 | 25 | NO | NO |
CVE-2021-41687HIGH DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests t | Jun 28, 2022 | 7.5 | 25 | NO | NO |
Signals from CVEs in this vendor scope (24 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Offis.
Media articles that mention a CVE ID that affects a product developed by Offis — matched by CVE ID, not by vendor name.