CVE-2024-23912

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

Out-of-bounds Read vulnerability in Merge DICOM Toolkit C/C++ on Windows.

When MC_Open_File() function is used to read a malformed DICOM data, it might result in over-reading memory buffer and could cause memory access violation.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Merative	Merge DICOM Toolkit C/C++	>= v5.0.0, <= v5.17.0
merative	merge_dicom_toolkit_c_c\+\+	>= v5.0.0, <= 5.17.0

References

Timeline

Published: May 3, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-239134.0Use of Out-of-range Pointer Offset vulnerability in Merge DICOM Toolkit C/C++ on Windows. When deprecated MC_XML_To_Message() function is u CVE-2024-239145.7Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows. When MC_Open_Association() function is us CVE-2024-239157.5Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vu CVE-2024-239167.5Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vu CVE-2024-239179.8In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible CVE-2024-239188.8Improper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged CVE-2024-239195.3Improper buffer restrictions in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privileg CVE-2024-23926.4The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions u CVE-2024-239208.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging s CVE-2024-239218.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging s CVE-2024-239226.8Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present at CVE-2024-239238.8Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to