(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4)…
Priority LOW 32CWE-264Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.
Summary
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.
Why it matters now
EPSS 0.00489 42nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:* | up to 3.6.1 | Vulnerable | OFFIS |
| cpe:2.3:a:offis:dcmtk:3.5.1:*:*:*:*:*:*:* | 3.5.1 | Vulnerable | OFFIS |
| cpe:2.3:a:offis:dcmtk:3.5.2:*:*:*:*:*:*:* | 3.5.2 | Vulnerable | OFFIS |
| cpe:2.3:a:offis:dcmtk:3.5.2a:*:*:*:*:*:*:* | 3.5.2a | Vulnerable | OFFIS |
| cpe:2.3:a:offis:dcmtk:3.5.3:*:*:*:*:*:*:* | 3.5.3 | Vulnerable | OFFIS |
| cpe:2.3:a:offis:dcmtk:3.5.4:*:*:*:*:*:*:* | 3.5.4 | Vulnerable | OFFIS |
| cpe:2.3:a:offis:dcmtk:3.6.0:*:*:*:*:*:*:* | 3.6.0 | Vulnerable | OFFIS |
- cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:* Versions up to 3.6.1 Vulnerable ·OFFIS
- cpe:2.3:a:offis:dcmtk:3.5.1:*:*:*:*:*:*:* Versions 3.5.1 Vulnerable ·OFFIS
- cpe:2.3:a:offis:dcmtk:3.5.2:*:*:*:*:*:*:* Versions 3.5.2 Vulnerable ·OFFIS
- cpe:2.3:a:offis:dcmtk:3.5.2a:*:*:*:*:*:*:* Versions 3.5.2a Vulnerable ·OFFIS
- cpe:2.3:a:offis:dcmtk:3.5.3:*:*:*:*:*:*:* Versions 3.5.3 Vulnerable ·OFFIS
- cpe:2.3:a:offis:dcmtk:3.5.4:*:*:*:*:*:*:* Versions 3.5.4 Vulnerable ·OFFIS
- cpe:2.3:a:offis:dcmtk:3.6.0:*:*:*:*:*:*:* Versions 3.6.0 Vulnerable ·OFFIS
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2013-6825
- 2026-10-03 Alias added: GHSA-9xf4-22r3-7ccc
References
More OFFIS Dcmtk vulnerabilities
- TI-2025-08922 DCMTK dcm2img diybrpxt.h memory corruption CVSS 4.0MEDIUM 4.8
- TI-2022-04568 DCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereference CVSS 4.0MEDIUM 4.8
- TI-2020-18990 DCMTK dcmqrscp parseQuota stack-based overflow CVSS 4.0MEDIUM 4.8
- TI-2024-22823 dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. CVSS 3.1MEDIUM 4.3
- TI-2019-16028 Out-of-bounds write in OFFIS.de DCMTK CVSS 3.1CRITICAL 9.8
- TI-2022-01961 OFFIS DCMTK Path Traversal CVSS 3.1CRITICAL 9.8
Sources
- CVE-2013-6825 · CVE Program
- CVE-2013-6825 · NVD
- FIRST EPSS
- GHSA-9xf4-22r3-7ccc · GitHub Advisory Database · CC BY 4.0
- CVE-2013-6825 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences