CVE-2026-5663 OFFIS CVE debrief

Who should care

Defenders responsible for systems using OFFIS DCMTK up to 3.7.0, particularly those with remote access to the storescp component, should assess exposure and prioritize patching. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure that affected systems are identified, patched, and monitored for suspicious activity.

Why it matters

CVE-2026-5663 is a security flaw in OFFIS DCMTK up to 3.7.0 that allows for os command injection via the storescp component, with remote exploitation possible. Defenders should prioritize patching vulnerable systems and monitoring for suspicious activity.

• Remote exploitation of the vulnerability is possible, allowing for os command injection.
• Applying a patch is the recommended action to fix this issue.
• Defenders should prioritize patching vulnerable systems, particularly those exposed to remote access.
• Verification of patch application and monitoring for suspicious activity are necessary.

Technical summary

The vulnerability is located in the storescp component of OFFIS DCMTK up to 3.7.0, specifically in the functions executeOnReception/executeOnEndOfStudy. A manipulation can result in os command injection, allowing for remote exploitation. The patch edbb085e45788dccaf0e64d71534cfca925784b8 is available to fix this issue. Defenders should prioritize patching vulnerable systems, particularly those exposed to remote access, and monitor for suspicious activity related to os command injection. The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions.

Defensive priority

Defenders should prioritize patching vulnerable systems, particularly those exposed to remote access.

Recommended defensive actions

• Apply the patch edbb085e45788dccaf0e64d71534cfca925784b8 to vulnerable systems
• Restrict access to the storescp component to trusted sources
• Monitor systems for suspicious activity related to os command injection
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is located in the storescp component of OFFIS DCMTK up to 3.7.0. Defenders should verify patch application, review system logs for suspicious activity related to os command injection, and ensure that access to the storescp component is restricted to trusted sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.