CVE-2026-5663 is an OS command injection in the storescp tool of OFFIS DCMTK up to version 3.7.0. It affects setups that run a command when DICOM data arrives. The fix is commit edbb085e, and a workaround is to avoid certain placeholders in the command.
What's affected
The record lists OFFIS DCMTK up to 3.7.0, in the executeOnReception and executeOnEndOfStudy functions of storescp. The researchers' advisory says all versions through 3.7.0 are affected and that no stable release contained the fix when it was written. The fix is commit edbb085e on DCMTK master. Check the DCMTK release page for a stable release that includes it.
The flaw matters only if storescp is run with the options that execute a command on reception or at the end of a study. Without them, the code path is not used.
NVD scores it 7.3. The researchers argue that 9.8 fits better, because the impact is code execution. Plan as if it is the higher figure.
How to check if you're exposed
First check whether you run storescp at all, and how.
storescp --version
- Search service definitions, scripts and container entrypoints for storescp with the exec on reception or exec on end of study options. Those are the affected configurations.
- DCMTK is packaged by most Linux distributions, so check the package version and your distribution's security notices as well.
- Look at what the commands use. The researchers name the filename, path and reverse DNS placeholders as the risky ones.
Run the free in-browser dependency scan at https://gold.safeguard.sh/scan against your manifest or lockfile. It lists vulnerable packages without installing anything.
What to do now
- Build DCMTK with commit edbb085e, or install a stable release that includes it once you have confirmed that.
- As an interim workaround, remove the filename, path and reverse hostname placeholders from exec on reception and exec on end of study commands.
- Turn on the option that disables host lookup, which the researchers say closes the reverse hostname route.
- Run storescp as a low privilege user with no access to more patient data than it needs.
- Restrict the DICOM listener to known sending systems with network rules.
Why it matters
The record lists CWE-78, OS command injection, and CWE-77, command injection. The tool builds a shell command by substituting values from the incoming DICOM association into a template, then hands the result to the shell. Existing cleaning removed path separators, but not characters that the shell treats as special.
In clinical settings the process that runs storescp often has access to patient records, so the stakes go beyond the server itself. This is a reminder that values from a network peer, including those that look harmless like identifiers and host names, should never be inserted into a shell command. Use a direct program call with an argument list instead. The record is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Am I safe if I never use the exec options?
The advisory ties the flaw to the options that run a command on reception or at end of study. If you do not use them, the affected code is not reached, but upgrade when a release is available.
Sources
Last reviewed: 19 October 2026.
