Back Linuxsecurity Debian 11: DCMTK Critical Memory Corruption Threat CVE-2025-9732 DLA-4363
CVE-2025-9732 Processing of an invalid DICOM image with a Photometric Interpretation of "YBR_FULL" and a Planar Configuration of "1" where the number of pixels stored does not match the expected number of pixels. This may lead to memory corruption. CVE-2022-4981 Various issues in the dcmqrscp configuration file parser that could cause application crashes when reading a malformed configuration file, due to insufficient checks of the input data. CVE-2020-36855 Stack-based overflow in the dcmqrscp config parser. For Debian 11 bullseye, these problems have been fixed in version 3.6.5-1+deb11u5. We recommend that you upgrade your dcmtk packages. For the detailed security status of dcmtk please refer to its security tracker page at: Further information Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at:
CVE-2025-9732 Processing of an invalid DICOM image with a Photometric Interpretation of "YBR_FULL" and a Planar Configuration of "1" where the number of pixels stored does not match the expected number of pixels. This may lead to memory corruption. CVE-2022-4981 Various issues in the dcmqrscp configuration file parser that could cause application crashes when reading a malformed configuration file, due to insufficient checks of the input data. CVE-2020-36855 Stack-based overflow in the dcmqrscp config parser. For Debian 11 bullseye, these problems have been fixed in version 3.6.5-1+deb11u5. We recommend that you upgrade your dcmtk packages. For the detailed security status of dcmtk please refer to its security tracker page at: Further information Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
