CVE-2021-41688: 
NixOS vulnerability analysis and mitigation

DCMTK through version 3.6.6 contains a memory handling vulnerability identified as CVE-2021-41688. The vulnerability stems from improper memory free operations where an object in the program is freed but its address continues to be used in other locations. When specific requests are sent to the dcmqrdb program, it can trigger a double free condition (NVD CVE).

The vulnerability is classified as a Double Free (CWE-415) issue. It has received a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability affects DCMTK versions up to and including 3.6.6 (NVD CVE).

When exploited, this vulnerability can be used to launch a Denial of Service (DoS) attack against the affected system. The high CVSS score particularly reflects the potential impact on system availability, while confidentiality and integrity remain unaffected (NVD CVE).

The vulnerability has been patched in subsequent releases. Debian has released security updates to address this issue in multiple versions: version 3.6.4-2.1+deb10u1 for Debian 10 buster, and fixes have been applied to newer versions in bullseye and bookworm (Debian LTS). Users are strongly recommended to upgrade their DCMTK installations to the patched versions.