OFFIS vulnerabilities
We track 9 vulnerabilities in OFFIS products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on October 8, 2026.
Latest OFFIS vulnerabilities
- 7.5 High severity
DCMTK: Uncontrolled Recursion
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deep
- 8.2 High severity
DCMTK: Out-of-bounds Read
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more fr
- 9.8 Critical severity
DCMTK: Improper Neutralization of Special Elements used in a Command
A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote ex
- 7.5 High severity
Dcmtk: NULL Pointer Dereference
A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DICOM file.
- 7.8 High severity
DCMTK: Improper Restriction of Operations within the Bounds of a Memory Buffer
An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.
- 7.8 High severity
DCMTK: Improper Restriction of Operations within the Bounds of a Memory Buffer
An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.
- 7.5 High severity
DCMTK: Incorrect Type Conversion or Cast
An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger thi
- 9.8 Critical severity
DCMTK: Improper Limitation of a Pathname to a Restricted Directory
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.
- 9.8 Critical severity
DCMTK: Improper Limitation of a Pathname to a Restricted Directory
OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution.