CVE-2025-9732

low-risk

Published 2025-08-31

A vulnerability was identified in DCMTK up to 3.6.9. This affects an unknown function in the library dcmimage/include/dcmtk/dcmimage/diybrpxt.h of the component dcm2img. Such manipulation leads to memory corruption. Local access is required to approach this attack. The name of the patch is 7ad81d69b. It is best practice to apply a patch to resolve this issue.

Do I need to act?

0.03% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

LOCAL / LOW complexity

Affected Products (1)

Dcmtk

Affected Vendors

Offis

References (5)

Patch https://github.com/DCMTK/dcmtk/commit/7ad81d69b

Permissions Required https://vuldb.com/?ctiid.322023

Third Party Advisory https://vuldb.com/?id.322023

Third Party Advisory https://vuldb.com/?submit.639772

Patch https://github.com/DCMTK/dcmtk/commit/7ad81d69b

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal