CVE-2024-27629

An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via...

7.8 HighFix available

An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly escaped and injected into a system call when certain types of compression are used.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.20%Up 0.2 points since Jun 29, 2024

What each source reports

CVE List Score used 7.8

Record: CVE-2024-27629
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-116
Updated: 2026-11-02

EUVDEUVD-2024-24823 7.8

Record: EUVD-2024-24823
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-25g3-v2pj-968v 7.8

An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via...

Record: GHSA-25g3-v2pj-968v
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-116
Updated: 2026-11-02

NVD 7.8

Record: CVE-2024-27629
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-116
Updated: 2026-11-02

OSV 7.8

Record: CVE-2024-27629
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2024-27629 7.8

Record: DEBIAN-CVE-2024-27629
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2024-27629 7.8

Record: UBUNTU-CVE-2024-27629
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

rordenlab dcm2niix

Affected packages

Affected packages
Package	Affected	Fixed
`dcm2niix` Debian:12	before 1.0.20220720-1+deb12u1, plus listed versions 1.0.20220720-1	1.0.20220720-1+deb12u1
`dcm2niix` Debian:13	before 1.0.20240202-1	1.0.20240202-1
`dcm2niix` Debian:14	before 1.0.20240202-1	1.0.20240202-1
`dcm2niix` Ubuntu:18.04:LTS	All versions, plus listed versions 1.0.20170923-11.0.20171017-11.0.20171215-1	None known
`dcm2niix` Ubuntu:20.04:LTS	All versions, plus listed versions 1.0.20181125-11.0.20181125-1build1	None known
`dcm2niix` Ubuntu:22.04:LTS	All versions, plus listed versions 1.0.20201102-11.0.20211006-11.0.20211006-1build1	None known
`dcm2niix` Ubuntu:24.04:LTS	All versions, plus listed versions 1.0.20220720-1build1	None known
`dcm2niix` Ubuntu:25.10	All versions, plus listed versions 1.0.20240202-1build11.0.20241211-1	None known
`dcm2niix` Ubuntu:26.10	All versions, plus listed versions 1.0.20250506-11.0.20250506-21.0.20250506-2build1	None known
`dcm2niix` Ubuntu:26.04:LTS	All versions, plus listed versions 1.0.20241211-11.0.20250506-1	None known

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-27629 is a high vulnerability (CVSS 7.8) in Rordenlab Dcm2niix, published June 28, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.20%, the 10th percentile. Fixed in dcm2niix 1.0.20220720-1+deb12u1.