Attack Chain

1. An attacker identifies a vulnerable OFFIS DCMTK instance running storescp exposed on the network.
2. The attacker crafts a malicious DICOM request containing specially crafted parameters designed to exploit the command injection vulnerability in the executeOnReception or executeOnEndOfStudy functions.
3. The storescp application receives the malicious DICOM request.
4. The vulnerable executeOnReception or executeOnEndOfStudy functions process the attacker-controlled parameters without proper sanitization.
5. The application attempts to execute a system command using the unsanitized input, injecting attacker-supplied code.
6. The injected code executes arbitrary commands on the underlying operating system with the privileges of the storescp process.
7. The attacker gains the ability to read sensitive files, modify system configurations, or execute malicious binaries.
8. The attacker establishes persistence on the system or pivots to other internal resources.

Impact

Successful exploitation of CVE-2026-5663 can lead to complete compromise of the affected system. This allows an attacker to execute arbitrary commands, potentially leading to data theft, denial of service, or further propagation within the network. The healthcare sector, which relies heavily on DICOM for medical imaging, is particularly at risk. Unpatched DCMTK instances expose sensitive patient data and critical infrastructure to potential attacks.

Recommendation

• Apply the patch edbb085e45788dccaf0e64d71534cfca925784b8 from the DCMTK GitHub repository to remediate CVE-2026-5663 immediately.
• Monitor network traffic for suspicious activity originating from or directed to DCMTK servers, specifically looking for unusual command execution patterns (see Sigma rule below).
• Implement input validation and sanitization for all user-supplied data processed by DCMTK applications to prevent command injection vulnerabilities in the future.
• Deploy the Sigma rules in this brief to your SIEM and tune for your environment.