A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.
CVE-2026-5663 is a critical OS command injection vulnerability in OFFIS DCMTK up to version 3.7.0 affecting the storescp component, allowing remote attackers to execute arbitrary commands. The vulnerability exists in the executeOnReception and executeOnEndOfStudy functions within dcmnet/apps/storescp.cc and requires immediate patching.
يؤثر هذا الثغر الأمني على وظائف معالجة استقبال الصور الطبية DICOM في تطبيق storescp من مكتبة OFFIS DCMTK. يسمح الثغر للمهاجمين البعيدين بحقن أوامر نظام التشغيل من خلال معالجة البيانات المرسلة عند استقبال الدراسات الطبية أو نهايتها.
A remote command injection flaw has been identified in OFFIS DCMTK versions up to 3.7.0 in the storescp application, enabling attackers to execute arbitrary OS commands. This vulnerability affects DICOM image storage operations and poses significant risk to healthcare infrastructure managing medical imaging data.
Immediately upgrade OFFIS DCMTK to version 3.7.1 or later, or apply patch edbb085e45788dccaf0e64d71534cfca925784b8. Restrict network access to storescp services using firewall rules, implement input validation for all DICOM operations, and monitor for suspicious command execution patterns in logs.
قم بترقية OFFIS DCMTK إلى الإصدار 3.7.1 أو أحدث فوراً، أو طبق التصحيح edbb085e45788dccaf0e64d71534cfca925784b8. قيّد الوصول إلى خدمات storescp باستخدام جدران الحماية، وطبق التحقق من صحة المدخلات لجميع عمليات DICOM، وراقب أنماط تنفيذ الأوامر المريبة في السجلات.