How severe is CVE-2026-5663?

CVE-2026-5663 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.

Is CVE-2026-5663 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-5663?

CVE-2026-5663 affects Offis Dcmtk. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-5663?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2026-5663 have an EU (EUVD) identifier?

Yes. CVE-2026-5663 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-19243.

When was CVE-2026-5663 published?

CVE-2026-5663 was published on 2026-04-06 and last updated on 2026-06-17.

CVE-2026-5663

CVE-2026-5663 is a high-severity vulnerability in Offis Dcmtk with a CVSS 3.x base score of 7.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-77.

Key facts

Severity: High (CVSS 3.x base score 7.3)
CVSS v2: 7.5
CVSS v4: 6.9
EPSS exploit prediction: 2% (75th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-19243
Weakness: CWE-77
Affected product: Offis Dcmtk
Published: 2026-04-06
Last modified: 2026-06-17

Description

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

Frequently asked questions

What is CVE-2026-5663?: A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.
How severe is CVE-2026-5663?: CVE-2026-5663 has a CVSS 3.x base score of 7.3, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability low.
Is CVE-2026-5663 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (75th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-5663?: CVE-2026-5663 affects Offis Dcmtk. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-5663?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2026-5663 have an EU (EUVD) identifier?: Yes. CVE-2026-5663 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-19243.
When was CVE-2026-5663 published?: CVE-2026-5663 was published on 2026-04-06 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:*

More vulnerabilities in Offis Dcmtk

CVE-2019-1010228 — Critical (CVSS 9.8): OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed…
CVE-2024-52333 — High (CVSS 8.4): An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A…
CVE-2024-47796 — High (CVSS 8.4): An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially…
CVE-2024-27628 — High (CVSS 8.1): Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT…
CVE-2025-25475 — High (CVSS 7.5): A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial…
CVE-2024-28130 — High (CVSS 7.5): An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS…

All CVEs affecting Offis Dcmtk →

Other CWE-77 (Command Injection) vulnerabilities

CVE-2026-23652 — Critical (CVSS 10.0): Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an…
CVE-2025-59818 — Critical (CVSS 10.0): This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file…
CVE-2025-64093 — Critical (CVSS 10.0): Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the…
CVE-2025-64090 — Critical (CVSS 10.0): This vulnerability allows authenticated attackers to execute commands via the hostname of the device.
CVE-2025-61492 — Critical (CVSS 10.0): A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to…
CVE-2025-10035 — Critical (CVSS 10.0): A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged…

Browse all CWE-77 (Command Injection) vulnerabilities →