CVE-2026-5663

CriticalCVSS 9.8/10Last modified Oct 26, 2026

Description

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77 CWE-78

Affected software

Vendor	Product	Versions
OFFIS	DCMTK	3.0; 3.1; 3.2; 3.3; 3.4; 3.5; 3.6; 3.7.0

References

https://github.com/DCMTK/dcmtk/commit/edbb085e45788dccaf0e64d71534cfca925784b8Patch
https://machinespirits.com/advisory/2e1627/Mitigation, Third Party Advisory
https://support.dcmtk.org/redmine/issues/1194Issue Tracking, Third Party Advisory
https://vuldb.com/submit/786061Third Party Advisory, VDB Entry
https://vuldb.com/vuln/355486Third Party Advisory, VDB Entry
https://vuldb.com/vuln/355486/ctiPermissions Required, VDB Entry

Timeline

Published: Apr 6, 2026
Last modified: Oct 26, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-566428.8Stack-based buffer overflow in Microsoft Fabric Data Warehouse allows an authorized attacker to execute code over a network.CVE-2026-566437.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-566447.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-566458.8Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.CVE-2026-566466.5Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spo CVE-2026-566478.8Integer overflow or wraparound in Windows Remote Access Service Infrastructure allows an authorized attacker to elevate privileges over a ne CVE-2026-566487.5Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a CVE-2026-566498.1Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unautho CVE-2026-56657.3A security vulnerability has been detected in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionalit CVE-2026-566507.8Heap-based buffer overflow in Windows Network File System allows an authorized attacker to elevate privileges locally.CVE-2026-566512.0Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without CVE-2026-566524.6Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell