Dcmtk · Dcmtk · CVE-2019-1010228
Name of the Vulnerable Software and Affected Versions:
DCMTK versions 3.6.3 and below
Description:
The issue affects the DcmRLEDecoder component, specifically the decompress() function in the dcrledec.h file. It can lead to a buffer overflow, resulting in possible code execution and confirmed Denial of Service. This can occur in various scenarios of DICOM file processing, such as DICOM to image conversion.
Recommendations:
For DCMTK versions 3.6.3 and below, update to version 3.6.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the DcmRLEDecoder component, specifically the decompress() function, until the update is applied.