Dcmtk

Vendor:

First CVE: Jun 10, 2014 · Active for 12 years

24

Total CVEs

More Total CVEs than 95% of tracked products

4.0

Avg CVEs / Year

Higher CVE frequency than 83% of tracked products

7.3

Avg CVSS

Higher Avg CVSS than 48% of tracked products

0.0%

KEV Rate

Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact Dcmtk over time

Volume of CVEsAvg CVSS Base Score

First CVE

Jun 10, 2014

12 years ago

Most Recent CVE

Apr 6, 2026

109 days ago

CVE Severity & Scoring

Dcmtk24 CVEs

33%

50%

17%

All CVEs352,231 CVEs

45%

40%

11%

MediumHighCritical

Attack Vector

Local5 (20.8%)

Network17 (70.8%)

Unknown1 (4.2%)

Physical0 (0.0%)

Adjacent Network1 (4.2%)

Attack Complexity

Low23 (95.8%)

High0 (0.0%)

Unknown1 (4.2%)

User Interaction

None20 (83.3%)

Unknown1 (4.2%)

Required3 (12.5%)

Privileges Required

Low5 (20.8%)

High0 (0.0%)

None18 (75.0%)

Unknown1 (4.2%)

Top CVEs

Signals from CVEs in this product scope (24 CVEs).

24 CVEs · Highest risk first

CVE	Published	CVSS	Risk	KEV	Exploit
CVE-2026-5663CRITICAL A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the componen	Apr 6, 2026	9.8	32	NO	NO
CVE-2019-1010228CRITICAL OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress(	Jul 22, 2019	9.8	32	NO	NO
CVE-2022-2120CRITICAL OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories	Jun 24, 2022	9.8	31	NO	NO
CVE-2022-2119CRITICAL OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under	Jun 24, 2022	9.8	30	NO	NO
CVE-2025-9732HIGH A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the component dcm2img. Such manip	Aug 31, 2025	7.8	26	NO	NO
CVE-2022-43272HIGH DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object.	Dec 2, 2022	7.5	25	NO	NO
CVE-2021-41690HIGH DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sen	Jun 28, 2022	7.5	25	NO	NO
CVE-2021-41689HIGH DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is nu	Jun 28, 2022	7.5	25	NO	NO
CVE-2021-41688HIGH DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqr	Jun 28, 2022	7.5	25	NO	NO
CVE-2021-41687HIGH DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests t	Jun 28, 2022	7.5	25	NO	NO

View all 24 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (24 CVEs).

CISA KEV

0 CVEs

0.0% of CVEs· Bottom 1%

Metasploit

0 CVEs

0.0% of CVEs· Bottom 1%

Nuclei

0 CVEs

0.0% of CVEs· Bottom 1%

ExploitDB

0 CVEs

0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (24 CVEs).

Media Mentions

Signals from CVEs in this product scope (24 CVEs).

Top CNAs Publishing CVEs For Dcmtk

Top CWEs

Versions

Version	CVE Count	Avg CVSS	Avg EPSS
3.6.9	4	6.4	0.4%
3.6.8	4	7.8	0.9%
3.6.7	1	7.5	1.6%
3.6.0	1	7.2	0.5%
3.5.4	1	7.2	0.5%
3.5.3	1	7.2	0.5%
3.5.2a	1	7.2	0.5%
3.5.2	1	7.2	0.5%
3.5.1	1	7.2	0.5%