CVE-2025-14841: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-14841 is a NULL pointer dereference vulnerability in OFFIS DCMTK (DICOM Toolkit) affecting all versions up to and including 3.6.9. The flaw resides in the functions DcmQueryRetrieveIndexDatabaseHandle::startFindRequest and DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest within dcmqrdb/libsrc/dcmqrdbi.cc, part of the dcmqrscp component. It was disclosed on December 18, 2025, with a fix available in DCMTK 3.7.0. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) and a CVSS v4.0 score of 1.9 (Low) per NVD remediation (Red Hat Advisory, VulDB).

The root cause is improper handling of a NULL pointer returned by dcelem->getString(s) in both startFindRequest and startMoveRequest functions (CWE-476: NULL Pointer Dereference; CWE-404: Improper Resource Shutdown or Release). When an invalid or malformed DICOM message is processed, getString() may return NULL, and the code previously passed this NULL pointer directly to OFStandard::strlcpy(), causing a segmentation fault. The fix (commit ffb1a4a) adds a NULL check before the copy operation, substituting an empty string when the pointer is NULL (GitHub Commit). Exploitation requires local access with low privileges and no user interaction. A proof-of-concept was provided by the bug reporter (邹 迪凯) to the DCMTK maintainers (GitHub Commit).

Successful exploitation causes a denial of service via application crash (segmentation fault) in the dcmqrscp DICOM query/retrieve server process. There is no impact on confidentiality or integrity — only availability is affected, and only at a low severity level. In healthcare environments where DCMTK is used for medical imaging workflows, repeated crashes of the dcmqrscp service could disrupt DICOM query and retrieve operations (Red Hat Advisory, VulDB).

A proof-of-concept was submitted by the original bug reporter and referenced in the patch commit, though no public exploit code has been released. There is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.000130), reflecting very low probability of exploitation in the near term (VulDB, GitHub Commit).

1. Gain local access: Obtain a local account with low privileges on a system running DCMTK 3.6.9 or earlier with the dcmqrscp service active.
2. Craft a malformed DICOM message: Construct a DICOM C-FIND or C-MOVE request containing a string-type element whose value is empty or otherwise causes dcelem->getString() to return NULL.
3. Submit the request: Send the crafted DICOM message to the dcmqrscp process, either directly via the DICOM network protocol or by triggering processing through a local interface.
4. Trigger the crash: The NULL pointer is passed to OFStandard::strlcpy() in startFindRequest or startMoveRequest, causing a segmentation fault and crashing the dcmqrscp process (GitHub Commit).

• Logs: Segmentation fault or crash entries in system logs (e.g., /var/log/syslog, /var/log/messages) referencing the dcmqrscp process; core dump files generated in the working directory of dcmqrscp.
• Process: Unexpected termination of the dcmqrscp process; repeated restarts of the DICOM query/retrieve service in a short time window.
• File System: Presence of core dump files (e.g., core, core.<pid>) in the dcmqrscp working directory following service crashes.

Upgrade OFFIS DCMTK to version 3.7.0, which includes the fix in commit ffb1a4a37d2c876e3feeb31df4930f2aed7fa030 (GitHub Release). Linux distribution packages are available or in progress for openSUSE, Debian LTS, and Mageia. As an interim measure, restrict local access to systems running vulnerable DCMTK versions, implement least-privilege access controls, and monitor for unexpected dcmqrscp crashes (Red Hat Advisory, Red Hat Bugzilla).