The flaw is located in OFFIS DCMTK’s storescp application, specifically within the executeOnReception and executeOnEndOfStudy functions defined in storescp.cc. A attacker can craft input that causes these functions to invoke system commands, leading to OS command injection. This allows remote attackers to run arbitrary commands with the privileges of the running storescp service, effectively giving full control over the host system.

Any installation of OFFIS DCMTK up to and including version 3.7.0 is affected. The vulnerability is confined to the storescp component of the DCMTK package. Users of the DCMTK distribution who run the storescp service are at risk.

The CVSS base score is 6.9, which indicates moderate severity, while the EPSS shows a probability of less than 1 %, implying a very low likelihood of exploitation at this time. The flaw is not listed in CISA’s KEV catalog. Exploitation requires remote access to the DCMTK storescp service and the ability to supply a specially crafted dataset that triggers the vulnerable function, thereby enabling command execution.