CVE-2019-1010228OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow.
Updated under an hour ago ()
Does this affect you?
It affects OFFIS.de DCMTK and 2 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 7.77%, higher than 95% of scored CVEs.
Do this next
Free account, 1 product
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
- CVSS
- 9.8 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 7.77% (percentile 95)
- Assigned by
- dwf
- NVD analysis
- Modified
- Record last updated
- Aug 5, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
OFFIS.de DCMTK offis.de:dcmtk (from the name) | 3.6.3 and below [fixed: 3.6.4, after commit 40917614e] | CNA record |
offis dcmtk offis:dcmtk | through 3.6.3 | NVD |
fedoraproject fedora fedoraproject:fedora | 29; 30 | NVD |
References
- https://support.dcmtk.org/redmine/issues/858x-refsource-misc, exploit, third-party-advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBKP2O24CTYIANEJTP4TVEPYEVSYV2RX/vendor-advisory, x-refsource-fedora
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NQOAULR72EYJQ4HS6YGLK2S6YNEXY2ET/vendor-advisory, x-refsource-fedora
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.