high8.4
CVE-2024-47796
An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8.
Impact
An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Offis | Dcmtk | Version 3.6.8 |
Weakness classification
References
- NVD record
- CVE.org record
- https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=89a6e399f1e17d08a8bc8cdaa05b2ac9a50cd4f6
- https://talosintelligence.com/vulnerability_reports/TALOS-2024-2122
- https://lists.debian.org/debian-lts-announce/2025/01/msg00032.html
- https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-2122