Medium severity · published Mar 17, 2025
CVE-2025-2357
DCMTK dcmjpls JPEG-LS Decoder memory corruption
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DC
DCMTK ·
3.6.9 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-2357
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-2357
Issue Tracking
https://support.dcmtk.org/redmine/issues/1155
Issue Tracking
https://support.dcmtk.org/redmine/issues/1155?tab=history#note-1
Permissions Required
https://vuldb.com/?ctiid.299824
Third Party Advisory
https://vuldb.com/?id.299824
Third Party Advisory
https://vuldb.com/?submit.513692
lists.debian.org
https://lists.debian.org/debian-lts-announce/2025/06/msg00025.html
More from DCMTK
7.8
CVE-2025-9732
DCMTK dcm2img diybrpxt.h memory corruption
5.5
CVE-2022-4981
DCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereference
5.5
CVE-2020-36855
DCMTK dcmqrscp parseQuota stack-based overflow