Every CVE Search/ Get API key

CVE-2024-28130

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage...

7.5 HighFix available

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

1.69%Up 1.6 points since Apr 24, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Record
CVE-2024-28130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-704
Updated
2026-11-02
EUVDEUVD-2024-25277 7.5

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Record
EUVD-2024-25277
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-29f8-5v89-7j3x 7.5

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage...

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Record
GHSA-29f8-5v89-7j3x
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-704
Updated
2026-11-02
NVD 7.5

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Record
CVE-2024-28130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-704
Updated
2026-11-02
OSV 7.5

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Record
CVE-2024-28130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-704
Updated
2026-11-02
OSVDEBIAN-CVE-2024-28130 7.5

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Record
DEBIAN-CVE-2024-28130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2024-28130 7.5

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

Record
UBUNTU-CVE-2024-28130
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVMGASA-2024-0251 No score

Updated dcmtk packages fix security vulnerabilities

Multiple vulnerabilities have been fixed in DCMTK, a collection of libraries and applications implementing large parts the DICOM standard for medical images. CVE-2024-28130 Segmentation faults due to incorrect typecast CVE-2024-34508 Segmentation fault via invalid DIMSE message CVE-2024-34509 Segmentation fault via invalid DIMSE message

Record
MGASA-2024-0251
Updated
2026-11-02
OSVopenSUSE-SU-2024:0113-1 No score

Security update for dcmtk

This update for dcmtk fixes the following issues:

  • Fixed incorrect type conversion in the DVPSSoftcopyVOI_PList:createFromImage functionality of OFFIS DCMTK (boo#1223324, CVE-2024-28130)

  • Add missing requirements for dcmtk-devel (boo#1220809)

  • Update to 3.6.8 See DOCS/CHANGES.368 for the full list of changes

Record
openSUSE-SU-2024:0113-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:13898-1 No score

dcmtk-3.6.8-4.1 on GA media

These are all security issues fixed in the dcmtk-3.6.8-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13898-1
Updated
2026-11-02
OSVUSN-7010-1 No score

dcmtk vulnerabilities

Jinsheng Ba discovered that DCMTK incorrectly handled certain requests. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2021-41687, CVE-2021-41688, CVE-2021-41689, CVE-2021-41690)

Sharon Brizinov and Noam Moshe discovered that DCMTK incorrectly handled pointers. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-2121)

It was discovered that DCMTK incorrectly handled certain inputs. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 20.04 LTS. (CVE-2022-43272)

It was discovered that DCMTK incorrectly handled certain inputs. If a user or an automated system were tricked into opening a certain specially crafted input file, a remote attacker could possibly use this issue to execute arbitrary code. This issue was only addressed in Ubuntu 20.04 LTS and Ubuntu 22.04 LTS. (CVE-2024-28130)

It was discovered that DCMTK incorrectly handled memory when processing an invalid incoming DIMSE message. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-34508, CVE-2024-34509)

Record
USN-7010-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dcmtk
Debian:12
 before 3.6.7-9~deb12u3, plus listed versions
3.6.7-83.6.7-9~deb12u13.6.7-9~deb12u2
3.6.7-9~deb12u3
dcmtk
Debian:13
 before 3.6.7-14
3.6.7-14
dcmtk
Debian:14
 before 3.6.7-14
3.6.7-14
dcmtk
Debian:10
From an advisory covering 9 CVEs
 before 3.6.4-2.1+deb10u1, plus listed versions
3.6.4-2.1
3.6.4-2.1+deb10u1
dcmtk
Debian:11
From an advisory covering 11 CVEs
 before 3.6.5-1+deb11u1, plus listed versions
3.6.5-1
3.6.5-1+deb11u1
dcmtk
Mageia:9
From an advisory covering 3 CVEs
 before 3.6.7-4.1.mga9
3.6.7-4.1.mga9
dcmtk
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
3.6.0-15.13.6.1~20150629-53.6.1~20150924-43.6.1~20150924-53.6.1~20150924-5ubuntu0.1~esm13.6.1~20150924-5ubuntu0.1~esm23.6.1~20150924-5ubuntu0.1~esm3
 None known
dcmtk
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
3.6.2-23.6.2-2build13.6.2-33.6.2-3build13.6.2-3build2
Show 4 moreShow less
3.6.2-3build33.6.2-3ubuntu0.1~esm13.6.2-3ubuntu0.1~esm23.6.2-3ubuntu0.1~esm3
 None known
dcmtk
Ubuntu:20.04:LTS
 before 3.6.4-2.1ubuntu0.1, plus listed versions
3.6.4-2.13.6.4-2.1build13.6.4-2.1build2
3.6.4-2.1ubuntu0.1
dcmtk
Ubuntu:Pro:22.04:LTS
 before 3.6.6-5ubuntu0.1~esm2, plus listed versions
3.6.5-13.6.6-3ubuntu13.6.6-3ubuntu23.6.6-43.6.6-53.6.6-5ubuntu0.1~esm1
3.6.6-5ubuntu0.1~esm2
Show 11 moreShow less
Affected packages
PackageAffectedFixed
dcmtk
Ubuntu:Pro:24.04:LTS
 All versions, plus listed versions
3.6.7-93.6.7-9.1build23.6.7-9.1build33.6.7-9.1build43.6.7-9.1ubuntu0.1~esm1
 None known
dcmtk
Ubuntu:25.10
 All versions, plus listed versions
3.6.9-43.6.9-53.6.9-5build1
 None known
dcmtk
Ubuntu:26.10
 All versions, plus listed versions
3.7.0+really3.6.9-13.7.0+really3.7.0-23.7.0+really3.7.0-53.7.0+really3.7.0-63.7.0+really3.7.0-7ubuntu1
 None known
dcmtk
Ubuntu:26.04:LTS
 All versions, plus listed versions
3.6.9-5build13.6.9-63.7.0+really3.6.9-1
 None known
dcmtk
Ubuntu:Pro:16.04:LTS
From an advisory covering 9 CVEs
 before 3.6.1~20150924-5ubuntu0.1~esm2, plus listed versions
3.6.0-15.13.6.1~20150629-53.6.1~20150924-43.6.1~20150924-53.6.1~20150924-5ubuntu0.1~esm1
3.6.1~20150924-5ubuntu0.1~esm2
dcmtk
Ubuntu:Pro:18.04:LTS
From an advisory covering 9 CVEs
 before 3.6.2-3ubuntu0.1~esm2, plus listed versions
3.6.2-23.6.2-2build13.6.2-33.6.2-3build13.6.2-3build23.6.2-3build33.6.2-3ubuntu0.1~esm1
3.6.2-3ubuntu0.1~esm2
dcmtk
Ubuntu:20.04:LTS
From an advisory covering 9 CVEs
 before 3.6.4-2.1ubuntu0.1, plus listed versions
3.6.4-2.13.6.4-2.1build13.6.4-2.1build2
3.6.4-2.1ubuntu0.1
dcmtk
Ubuntu:Pro:22.04:LTS
From an advisory covering 9 CVEs
 before 3.6.6-5ubuntu0.1~esm2, plus listed versions
3.6.5-13.6.6-3ubuntu13.6.6-3ubuntu23.6.6-43.6.6-53.6.6-5ubuntu0.1~esm1
3.6.6-5ubuntu0.1~esm2
dcmtk
Ubuntu:Pro:24.04:LTS
From an advisory covering 9 CVEs
 before 3.6.7-9.1ubuntu0.1~esm1, plus listed versions
3.6.7-93.6.7-9.1build23.6.7-9.1build33.6.7-9.1build4
3.6.7-9.1ubuntu0.1~esm1
dcmtk
SUSE:Package Hub 15 SP5
 before 3.6.8-bp155.3.3.1
3.6.8-bp155.3.3.1
dcmtk
openSUSE:Leap 15.5
 before 3.6.8-bp155.3.3.1
3.6.8-bp155.3.3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-28130 is a high vulnerability (CVSS 7.5) in Offis Dcmtk, published April 23, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.69%, the 77th percentile. Fixed in dcmtk 3.6.7-9~deb12u3.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open