CVE-2025-14607: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-14607 is a memory corruption vulnerability in OFFIS DCMTK (DICOM Toolkit) affecting all versions up to and including 3.6.9. The flaw resides in the DcmByteString::makeDicomByteString function within dcmdata/libsrc/dcbytstr.cc of the dcmdata component. It was published on December 13, 2025, and is resolved in DCMTK version 3.7.0 (VulDB, ENISA EUVD). The vulnerability carries a CVSS v3.1 base score of 6.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Feedly).

The root cause (CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer) is an off-by-one null-termination error when processing DICOM datasets containing illegal odd-length attributes with text Value Representations (VRs). When such a dataset is read from a file or received over a network connection, DcmElement::getString() may return a pointer to a string that is not properly null-terminated. Subsequent use of C string functions such as strlen() or strcpy() on that string results in a read beyond the end of the allocated buffer, causing a segmentation fault or memory corruption. The fix (commit 4c0e5c10079392c594d6a7abd95dd78ac0aa556a) adds an additional null byte at value[lengthField+1] to ensure proper termination for odd-length fields (GitHub Commit, DCMTK Issue #1184).

Successful exploitation can result in limited confidentiality loss (e.g., reading out-of-bounds memory contents), integrity degradation, and availability disruption (application crash/segmentation fault) on systems processing DICOM data. Because DCMTK is widely used in medical imaging infrastructure — including PACS servers, radiology workstations, and healthcare network nodes — exploitation could disrupt clinical workflows or expose sensitive patient imaging data. The attack requires low privileges and no user interaction, making it feasible for a network-adjacent attacker to trigger the flaw by sending a crafted DICOM message (Feedly, ENISA EUVD).

A proof-of-concept was submitted by researcher Zou Dikai alongside the bug report to the DCMTK project, which directly led to the patch (GitHub Commit). There is no public evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.046% (very low probability of exploitation in the near term), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly). The vulnerability is detectable by Nessus (plugin 278634) and Qualys (ID 6273433) (Tenable).

1. Reconnaissance: Identify network-exposed DICOM services (typically TCP port 104 or 11112) running DCMTK versions up to 3.6.9 using tools like Shodan, Censys, or nmap with DICOM service detection scripts.
2. Craft malicious DICOM dataset: Construct a DICOM file or network message containing an attribute with a text VR (e.g., LO, SH, CS) whose length field specifies an odd-length value, which is illegal per the DICOM standard.
3. Transmit the payload: Send the crafted DICOM C-STORE or C-FIND request to the target DCMTK-based service over the network. No authentication is required beyond low-privilege DICOM association establishment.
4. Trigger memory corruption: The vulnerable DcmByteString::makeDicomByteString function processes the odd-length attribute and returns a non-null-terminated string pointer. When the application subsequently calls C string functions on this pointer, a read beyond the buffer boundary occurs.
5. Achieve impact: Depending on memory layout, the result may be a segmentation fault (denial of service), exposure of adjacent memory contents (information disclosure), or potential for further memory corruption primitives (GitHub Commit, DCMTK Issue #1184).

• Network: Unexpected or malformed DICOM association requests on TCP ports 104 or 11112 containing attributes with odd-length text VR fields; connections from unknown or external IP addresses to DICOM service ports.
• Logs: DCMTK application logs showing errors related to odd-length attribute handling, segmentation faults, or unexpected process termination; DICOM error codes indicating malformed datasets.
• Process: Abnormal termination (crash/core dump) of DCMTK-based processes (e.g., dcmqrscp, storescp, findscp) without a clear operational cause; repeated restarts of DICOM service daemons.
• File System: Core dump files generated by DCMTK processes in the working directory or system crash directories, potentially containing memory contents from around the time of exploitation.

The primary remediation is to upgrade OFFIS DCMTK to version 3.7.0 or later, which contains the fix in commit 4c0e5c10079392c594d6a7abd95dd78ac0aa556a (GitHub Commit, DCMTK Release). Linux distribution packages are available: openSUSE has released dcmtk-3.7.0, Debian LTS issued advisory DLA-4443-1, and Mageia issued advisory MGASA-2026-0040 (Linux Security openSUSE, Debian LTS, Linux Security Mageia). As a temporary workaround where upgrading is not immediately possible, restrict network access to DICOM service ports (104/11112) using firewall rules to limit exposure to trusted hosts only.

The vulnerability was reported to the DCMTK project by researcher Zou Dikai, who also provided a proof-of-concept, leading to a prompt patch by the DCMTK maintainer (GitHub Commit). Multiple Linux distributions (openSUSE, Debian LTS, Mageia) have issued security advisories and updated packages, indicating active downstream response (Debian LTS). No significant broader media coverage or notable social media discussion beyond standard vulnerability aggregator postings has been observed.