Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
1.9

DCMTK: Unpatched versions may crash from malicious data

CVE-2020-36855 · published 1 year ago
Summary

A flaw in DCMTK's dcmqrscp component allows an attacker with local access to cause the program to crash. This can happen when the program processes malicious data. To fix this issue, update to version 3.6.6 or later.

What to do
  • Update offis dcmtk to version 3.6.6 or later.
Affected software
Ecosystem VendorProductAffected versions
– offis dcmtk < 3.6.6
cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:*
Ubuntu:Pro:16.04:LTS canonical dcmtk All versions
Ubuntu:Pro:18.04:LTS canonical dcmtk All versions
Ubuntu:Pro:20.04:LTS canonical dcmtk All versions
Original advisory text
A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of the argument StorageQuota leads to st...
A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of the argument StorageQuota leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 3.6.6 is sufficient to fix this issue. The identifier of the patch is 0fef9f02e. It is recommended to upgrade the affected component.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
1.9 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
CWE-121Stack-based Buffer Overflow
Timeline
Published21 Oct 2025
Updated4 Nov 2026
First seen7 Mar 2026
Sources
UBUNTU-CVE-2020-36855 · OSV
CVE-2020-36855 · NVD
CVE-2020-36855 · OSV
Track software like this
Free during beta