CVE-2022-2121

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a denial-of-service condition.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
OFFIS	DCMTK	>= unspecified, < 3.6.7
offis	dcmtk	< 3.6.7

References

https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01Mitigation, Third Party Advisory, US Government Resource
https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00032.html
https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01Mitigation, Third Party Advisory, US Government Resource

Timeline

Published: Jun 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-212108.8An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP req CVE-2022-212117.5This affects all versions of package posix. When invoking the toString method, it will fallback to 0x0 value, as the value of toString is no CVE-2022-212126.5Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of CVE-2022-212137.5This affects all versions of package mout. The deepFillIn function can be used to 'fill missing properties recursively', while the deepMixIn CVE-2022-212147.8The affected product is vulnerable to a heap-based buffer overflow, which may lead to code execution.CVE-2022-212159.8This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are CVE-2022-212166.8Insufficient granularity of access control in out-of-band management in some Intel(R) Atom and Intel Xeon Scalable Processors may allow a pr CVE-2022-212179.8An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-craft CVE-2022-212185.5Uncaught exception in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable CVE-2022-212197.8Out-of-bounds read vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause in CVE-2022-21227.8DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which ca CVE-2022-212207.8Improper restriction of XML external entity for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to