CVE-2026-5663

Katalog CVE

CVSS 9.8 · Critical EPSS 2,8%

Kerentanan Improper Neutralization of Special Elements used in a Command ('Command Injection') pada offis dcmtk. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

Rincian

Terbit di NVD

6 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

2,8% peluang dieksploitasi; lebih tinggi dari 86,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8 patch
• https://machinespirits.com/advisory/2e1627/ mitigasi · advisory pihak ketiga
• https://support.dcmtk.org/redmine/issues/1194 issue tracking · advisory pihak ketiga
• https://vuldb.com/submit/786061 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/355486 advisory pihak ketiga · vdb entry
• https://vuldb.com/vuln/355486/cti permissions required · vdb entry