CVE-2024-23914

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows.

When MC_Open_Association() function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it might result in an unhandled exception.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-134

Affected software

Vendor	Product	Versions
Merative	Merge DICOM Toolkit C/C++	>= v5.6.0, <= v5.17.0
merative	merge_dicom_toolkit_c_c\+\+	>= 5.6.0, <= 5.17.0

References

Timeline

Published: May 3, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-239157.5Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vu CVE-2024-239167.5Unchecked Return Value to NULL Pointer Dereference vulnerability in Open Networking Foundation (ONF) libfluid (libfluid_msg module). This vu CVE-2024-239179.8In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible CVE-2024-239188.8Improper conditions check in some Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX may allow a privileged CVE-2024-239195.3Improper buffer restrictions in some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privileg CVE-2024-23926.4The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Newsletter widget in all versions u CVE-2024-239208.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging s CVE-2024-239218.8This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of ChargePoint Home Flex charging s CVE-2024-239226.8Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability. This vulnerability allows physically present at CVE-2024-239238.8Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to CVE-2024-239246.8Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present CVE-2024-239286.5This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of Pion