CVE-2020-36855

Katalog CVE

CVSS 5.5 · Medium EPSS 0,25%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada offis dcmtk. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of the argument StorageQuota leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 3.6.6 is sufficient to fix this issue. The identifier of the patch is 0fef9f02e. It is recommended to upgrade the affected component.

Rincian

Terbit di NVD

21 Oktober 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-121: Stack-based Buffer Overflow

EPSS (30 hari)

0,25% peluang dieksploitasi; lebih tinggi dari 14,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://shimo.im/docs/rp3OMVMDPKtjn0km/ exploit · advisory pihak ketiga
• https://vuldb.com/?id.329028 advisory pihak ketiga · vdb entry
• https://vuldb.com/?submit.673137 advisory pihak ketiga · vdb entry
• https://shimo.im/docs/rp3OMVMDPKtjn0km/read exploit · advisory pihak ketiga
• https://vuldb.com/?ctiid.329028 permissions required · vdb entry