CVE-2019-1010228
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code...
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
- Record
CVE-2019-1010228- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
- Record
CVE-2019-1010228- Updated
- 2026-11-02
EUVDEUVD-2019-1970 No score
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
- Record
EUVD-2019-1970- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pqj4-82hx-mp43
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code...
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
- Record
GHSA-pqj4-82hx-mp43- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-787
- Updated
- 2026-11-02
OSV
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
- Record
CVE-2019-1010228- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-1010228
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
- Record
DEBIAN-CVE-2019-1010228- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-1010228
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. The impact is: Possible code execution and confirmed Denial of Service. The component is: DcmRLEDecoder::decompress() (file dcrledec.h, line 122). The attack vector is: Many scenarios of DICOM file processing (e.g. DICOM to image conversion). The fixed version is: 3.6.4, after commit 40917614e.
- Record
UBUNTU-CVE-2019-1010228- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUSN-5882-1 No score
dcmtk vulnerabilities
Gjoko Krstic discovered that DCMTK incorrectly handled buffers. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2015-8979)
Omar Ganiev discovered that DCMTK incorrectly handled buffers. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-1010228)
Jinsheng Ba discovered that DCMTK incorrectly handled certain requests. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2021-41687, CVE-2021-41688, CVE-2021-41689, and CVE-2021-41690)
Sharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled certain inputs. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-2119 and CVE-2022-2120)
Sharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled pointers. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS. (CVE-2022-2121)
It was discovered that DCMTK incorrectly handled certain inputs. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 22.10. (CVE-2022-43272)
- Record
USN-5882-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dcmtkDebian:12 |
before 3.6.4-1 | 3.6.4-1 |
dcmtkDebian:13 |
before 3.6.4-1 | 3.6.4-1 |
dcmtkDebian:14 |
before 3.6.4-1 | 3.6.4-1 |
dcmtkUbuntu:Pro:16.04:LTS |
before 3.6.1~20150924-5ubuntu0.1~esm1, plus listed versions 3.6.0-15.13.6.1~20150629-53.6.1~20150924-43.6.1~20150924-5 |
3.6.1~20150924-5ubuntu0.1~esm1 |
dcmtkUbuntu:Pro:18.04:LTS |
before 3.6.2-3ubuntu0.1~esm1, plus listed versions 3.6.2-23.6.2-2build13.6.2-33.6.2-3build13.6.2-3build23.6.2-3build3 |
3.6.2-3ubuntu0.1~esm1 |
dcmtkUbuntu:Pro:16.04:LTS From an advisory covering 10 CVEs |
before 3.6.1~20150924-5ubuntu0.1~esm1, plus listed versions 3.6.0-15.13.6.1~20150629-53.6.1~20150924-43.6.1~20150924-5 |
3.6.1~20150924-5ubuntu0.1~esm1 |
dcmtkUbuntu:Pro:18.04:LTS From an advisory covering 10 CVEs |
before 3.6.2-3ubuntu0.1~esm1, plus listed versions 3.6.2-23.6.2-2build13.6.2-33.6.2-3build13.6.2-3build23.6.2-3build3 |
3.6.2-3ubuntu0.1~esm1 |
dcmtkUbuntu:Pro:20.04:LTS From an advisory covering 10 CVEs |
before 3.6.4-2.1ubuntu0.1~esm1, plus listed versions 3.6.4-2.13.6.4-2.1build13.6.4-2.1build2 |
3.6.4-2.1ubuntu0.1~esm1 |
dcmtkUbuntu:Pro:22.04:LTS From an advisory covering 10 CVEs |
before 3.6.6-5ubuntu0.1~esm1, plus listed versions 3.6.5-13.6.6-3ubuntu13.6.6-3ubuntu23.6.6-43.6.6-5 |
3.6.6-5ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-1010228 is a critical vulnerability (CVSS 9.8) in Offis Dcmtk, published July 22, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.77%, the 94th percentile. Fixed in dcmtk 3.6.4-1.
References
support.dcmtk.org/redmine/issues/858
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PBKP2O24CTYIANEJTP4TVEPYEVSYV2RX
nvd.nist.gov/vuln/detail/CVE-2019-1010228
Show 15 moreShow less
github.com/advisories/GHSA-pqj4-82hx-mp43
security-tracker.debian.org/tracker/CVE-2019-1010228
ubuntu.com/security/CVE-2019-1010228
cve.org/CVERecord?id=CVE-2019-1010228