CVE-2024-27628
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via...
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
- Record
CVE-2024-27628- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2024-24822
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
- Record
EUVD-2024-24822- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4vfx-5jf7-gfhv
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via...
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
- Record
GHSA-4vfx-5jf7-gfhv- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-120
- Updated
- 2026-11-02
NVD
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
- Record
CVE-2024-27628- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-120
- Updated
- 2026-11-02
OSV
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
- Record
CVE-2024-27628- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-27628
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
- Record
DEBIAN-CVE-2024-27628- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2024-27628
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component.
- Record
UBUNTU-CVE-2024-27628- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2024-0380 No score
Updated dcmtk packages fix security vulnerability
A buffer overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component. (CVE-2024-27628)
- Record
MGASA-2024-0380- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14514-1 No score
dcmtk-3.6.8-5.1 on GA media
These are all security issues fixed in the dcmtk-3.6.8-5.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14514-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:0053-1 No score
Security update for dcmtk
This update for dcmtk fixes the following issues:
Update to 3.6.9. See DOCS/CHANGES.368 for the full list of changes
Security issues fixed:
- CVE-2024-27628: Fixed buffer overflow via the EctEnhancedCT method (boo#1227235)
- CVE-2024-34508: Fixed a segmentation fault via an invalid DIMSE message (boo#1223925)
- CVE-2024-34509: Fixed segmentation fault via an invalid DIMSE message (boo#1223943)
- CVE-2024-47796: Fixed out-of-bounds write due to improper array index validation in the nowindow functionality (boo#1235810)
- CVE-2024-52333: Fixed out-of-bounds write due to improper array index validation in the determineMinMax functionality (boo#1235811)
- Record
openSUSE-SU-2025:0053-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dcmtkDebian:12 |
before 3.6.7-9~deb12u2, plus listed versions 3.6.7-83.6.7-9~deb12u1 |
3.6.7-9~deb12u2 |
dcmtkDebian:13 |
before 3.6.8-6 | 3.6.8-6 |
dcmtkDebian:14 |
before 3.6.8-6 | 3.6.8-6 |
dcmtkMageia:9 |
before 3.6.7-4.2.mga9 | 3.6.7-4.2.mga9 |
dcmtkUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.6.0-15.13.6.1~20150629-53.6.1~20150924-43.6.1~20150924-53.6.1~20150924-5ubuntu0.1~esm13.6.1~20150924-5ubuntu0.1~esm23.6.1~20150924-5ubuntu0.1~esm3 |
None known |
dcmtkUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.6.2-23.6.2-2build13.6.2-33.6.2-3build13.6.2-3build2 Show 4 moreShow less3.6.2-3build33.6.2-3ubuntu0.1~esm13.6.2-3ubuntu0.1~esm23.6.2-3ubuntu0.1~esm3 |
None known |
dcmtkUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.6.4-2.13.6.4-2.1build13.6.4-2.1build23.6.4-2.1ubuntu0.1~esm13.6.4-2.1ubuntu0.13.6.4-2.1ubuntu0.1+esm13.6.4-2.1ubuntu0.23.6.4-2.1ubuntu0.2+esm1 |
None known |
dcmtkUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 3.6.5-13.6.6-3ubuntu13.6.6-3ubuntu23.6.6-43.6.6-53.6.6-5ubuntu0.1~esm13.6.6-5ubuntu0.1~esm2 |
None known |
dcmtkUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 3.6.7-93.6.7-9.1build23.6.7-9.1build33.6.7-9.1build43.6.7-9.1ubuntu0.1~esm1 |
None known |
dcmtkUbuntu:25.10 |
All versions, plus listed versions 3.6.9-43.6.9-53.6.9-5build1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
dcmtkUbuntu:26.10 |
All versions, plus listed versions 3.7.0+really3.6.9-13.7.0+really3.7.0-23.7.0+really3.7.0-53.7.0+really3.7.0-63.7.0+really3.7.0-7ubuntu1 |
None known |
dcmtkUbuntu:26.04:LTS |
All versions, plus listed versions 3.6.9-5build13.6.9-63.7.0+really3.6.9-1 |
None known |
dcmtkopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 3.6.8-5.1 | 3.6.8-5.1 |
dcmtkSUSE:Package Hub 15 SP6 From an advisory covering 5 CVEs |
before 3.6.9-bp156.4.3.1 | 3.6.9-bp156.4.3.1 |
dcmtkopenSUSE:Leap 15.6 From an advisory covering 5 CVEs |
before 3.6.9-bp156.4.3.1 | 3.6.9-bp156.4.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-27628 is a high vulnerability (CVSS 8.1) in Offis Dcmtk, published June 28, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in dcmtk 3.6.7-9~deb12u2.
References
support.dcmtk.org/redmine/issues/1108
github.com/DCMTK/dcmtk/commit/ec52e99e1e33fc39810560421c0833b02da567b3
nvd.nist.gov/vuln/detail/CVE-2024-27628
security-tracker.debian.org/tracker/CVE-2024-27628
Show 17 moreShow less
advisories.mageia.org/MGASA-2024-0380.html
bugs.mageia.org/show_bug.cgi?id=33798
lists.opensuse.org/archives/list/[email protected]/message/U3LXLFP2Q7LBLGBNWEPO3O2ZZ2JPCYEU
ubuntu.com/security/CVE-2024-27628
cve.org/CVERecord?id=CVE-2024-27628
suse.com/security/cve/CVE-2024-27628
bugzilla.suse.com/1223925