High severity · published Jun 28, 2022
CVE-2021-41687
DCMTK through 3.6.6 does not handle memory free properly
7.5
CVSS
1.8%
EPSS
No
On KEV
Description
DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.8% · higher than 79% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
Dcmtk · Offis
through 3.6.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41687
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41687
Product
https://github.com/DCMTK/dcmtk
Patch
https://github.com/DCMTK/dcmtk/commit/a9697dfeb672b0b9412c00c7d36d801e27ec85cb
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/01/msg00032.html
More from Dcmtk
9.8
CVE-2026-5663
OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection
9.8
CVE-2022-2119
OFFIS DCMTK Path Traversal
9.8
CVE-2022-2120
OFFIS DCMTK Path Traversal
9.8
CVE-2019-1010228
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow
8.2
CVE-2026-97059
DCMTK through 3.7.0 Heap Over-read via NumberOfFrames