A security flaw has been discovered in OFFIS DCMTK up to 3

DCMTK's storescp is the reference DICOM Storage Service Class Provider — the daemon that sits on a PACS ingress port and accepts image objects from CT scanners, MRIs, ultrasounds, and modality workstations. Versions up to and including 3.7.0 carry a command-injection flaw in the executeOnReception and executeOnEndOfStudy hooks inside dcmnet/apps/storescp.cc. Those hooks let an operator run a shell command (--exec-on-reception <cmd>) when a study lands, and the hook substitutes attacker-influenced fields (filename, calling AE title, study UID) into the command line without neutralizing shell metacharacters. Fix ships as commit edbb085e45788dccaf0e64d71534cfca925784b8, which routes filenames through a hardened OFStandard::sanitizeFilename() allow-list.

The vendor-assigned HIGH / 7.3 with C:L/I:L/A:L is *undersold*. Once the executeOn hooks are enabled — which is the entire point of running storescp as a PACS ingress — this is unauthenticated remote code execution as the service account, not a partial-impact issue. The offsetting reality is that vanilla storescp with no --exec-on-* argument is not exploitable, and most hospitals firewall the DICOM port (104/11112) to a defined modality VLAN. Net: real severity is a firm HIGH, tipping toward CRITICAL only in ICS-medical footprints where storescp is internet-reachable or bridging clinical/OT segments.

Why this verdict

• Role multiplier — PACS ingress: storescp is definitionally a healthcare imaging component. Chain ends in RCE on a host that brokers modality creds, MWL, HL7 feeds, and often domain identity. Floor is HIGH.
• Role multiplier — research/lab install: on a bench workstation the same chain yields lab-only impact, no fleet blast radius. This role does not lift the floor higher.
• Impact undersold by vendor CVSS: the L/L/L subscores don't match arbitrary shell execution — 9.8 would be closer on impact alone, and we adjust the reassessed score up from 7.3.
• Friction — conditional trigger: exec-on hooks are opt-in. Fraction of storescp deployments that set them is unknown but non-trivial (post-processing pipelines commonly do). This holds the verdict at HIGH, not CRITICAL.
• Friction — network exposure: most enterprise PACS restrict DICOM port to modality VLAN; internet-facing storescp population is a few thousand hosts globally, share running DCMTK unknown.
• Friction — no active exploitation and EPSS 1.7%: no KEV entry, no observed campaigns, low near-term likelihood — but this only affects urgency, not the ceiling on severity.

Why not higher?

CRITICAL requires either KEV-level active exploitation or a canonical-role floor of CRITICAL. storescp qualifies as a high-value healthcare role but the exec-on hook precondition materially reduces the exploitable share of the install base — many storescp instances are pure receivers with no shell hook configured, giving zero-impact exposure. Absent public exploitation, HIGH is the correct bucket.

Why not lower?

MEDIUM would ignore that this is unauthenticated remote command execution on a healthcare imaging component with regulatory (HIPAA, MDR) and patient-safety adjacency. The vendor's own 7.3 places it at the HIGH boundary, and the true impact profile (H/H/H once triggered) argues against relaxing to MEDIUM.

1. Inventory every storescp invocation for --exec-on-* flags — Search process arguments, systemd units, and PACS appliance startup scripts for --exec-on-reception, --exec-on-eostudy, --rename-on-eostudy. Any hit is exploitable. Complete inventory within the noisgate HIGH mitigation SLA (30 days).
2. Strip exec hooks or replace with post-processing daemon — Where hooks exist, remove the flag and move post-processing to a queue consumer (dcm4chee-arc, custom daemon that reads the storage directory and validates filenames). Deploy within 30 days per noisgate HIGH mitigation SLA.
3. Enforce DICOM segmentation and calling-AE allow-list — Restrict TCP 104/11112 to the modality VLAN and configure storescp --aetitle/--acse-timeout to reject unknown calling AE titles. This shrinks the reachable attacker population dramatically.
4. Require DICOM-TLS with mutual auth on external interfaces — For any storescp that must receive across trust boundaries (teleradiology, research consortia), enable +tls with client-cert validation. Anonymous SCU associations become impossible.
5. Roll DCMTK patch into golden PACS image — Cherry-pick commit edbb085e45788dccaf0e64d71534cfca925784b8 (or upgrade to the first tagged release containing it) into your PACS build. Ship to production within the noisgate HIGH remediation SLA of 180 days; sooner if exec hooks are in use.
6. Deploy EDR/anomaly detection to imaging hosts — Alert on storescp spawning sh, cmd.exe, powershell.exe, or any non-standard child process. Medical-device-aware NDR (Claroty, Medigate, Armis) is the fallback where host agents are prohibited.

Run on each Linux/Unix host suspected of running DCMTK storescp — invoke as root or the dicom service account with sudo ./check-cve-2026-5663.sh. Detects installed DCMTK version, checks for the sanitizeFilename patch symbol, and inspects running processes for the exploitable --exec-on-* flags.

#!/usr/bin/env bash
# noisgate verification: CVE-2026-5663 (DCMTK storescp command injection)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u

STATUS="UNKNOWN"
DETAIL=""

# 1. Locate storescp binary
BIN=$(command -v storescp || true)
if [ -z "$BIN" ]; then
  for p in /usr/local/bin/storescp /opt/dcmtk/bin/storescp /usr/bin/storescp; do
    [ -x "$p" ] && BIN="$p" && break
  done
fi

if [ -z "$BIN" ]; then
  echo "UNKNOWN: storescp binary not found on PATH"
  exit 2
fi

# 2. Extract reported version
VER=$($BIN --version 2>&1 | grep -Eo '[0-9]+\.[0-9]+\.[0-9]+' | head -1)
DETAIL="binary=$BIN version=${VER:-unknown}"

# 3. Version comparison — anything <= 3.7.0 without patch is vulnerable
vuln_by_version=0
if [ -n "$VER" ]; then
  # crude semver: sort -V then check
  first=$(printf '%s\n%s\n' "$VER" "3.7.0" | sort -V | head -1)
  if [ "$first" = "$VER" ] || [ "$VER" = "3.7.0" ]; then
    vuln_by_version=1
  fi
fi

# 4. Look for the patched sanitizeFilename symbol in the binary / libofstd
SYMHIT=0
for lib in "$BIN" $(ldd "$BIN" 2>/dev/null | awk '/libofstd|libdcmnet/ {print $3}'); do
  [ -r "$lib" ] || continue
  if strings "$lib" 2>/dev/null | grep -q 'sanitizeFilename'; then
    SYMHIT=1
  fi
done

# 5. Check running processes for --exec-on-* flags
EXEC_FLAG=$(ps -eo args= 2>/dev/null | grep -E '[s]torescp' | grep -Eo -- '--exec-on-(reception|eostudy)|--rename-on-eostudy' | head -1)

if [ $vuln_by_version -eq 1 ] && [ $SYMHIT -eq 0 ]; then
  STATUS="VULNERABLE"
  [ -n "$EXEC_FLAG" ] && DETAIL="$DETAIL exploit-precondition=CONFIGURED($EXEC_FLAG)" || DETAIL="$DETAIL exploit-precondition=not-currently-set-but-binary-vulnerable"
elif [ $SYMHIT -eq 1 ]; then
  STATUS="PATCHED"
  DETAIL="$DETAIL sanitizeFilename=present"
else
  STATUS="UNKNOWN"
fi

echo "$STATUS: $DETAIL"
case "$STATUS" in
  PATCHED) exit 0 ;;
  VULNERABLE) exit 1 ;;
  *) exit 2 ;;
esac

Sources

1. GitHub Security Advisory GHSA-c42x-qh72-7h87
2. CISA ICSMA-26-181-01 — OFFIS DCMTK Toolkit
3. SentinelOne vulnerability database — CVE-2026-5663
4. RedPacket Security — CVE-2026-5663 alert
5. OpenCVE — DCMTK vendor CVE history
6. CodeAnt — DCMTK storescp OS command injection analysis
7. CWE-77 — Command Injection
8. DCMTK project