« Volver al listado

CVE-2024-23913

Estado: AplazadaMedia (4)—

Use of Out-of-range Pointer Offset vulnerability in Merge DICOM Toolkit C/C++ on Windows.

When deprecated MC_XML_To_Message() function is used to read a malformed DICOM XML file, it might result in memory access violation.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Merge — Dicom ToolkitAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-23913",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-23913",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-06-17T19:02:05.671226Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "prodsec@nozominetworks.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "prodsec@nozominetworks.com",
      "affectedData": [
        {
          "vendor": "Merative",
          "product": "Merge DICOM Toolkit C/C++",
          "versions": [
            {
              "status": "affected",
              "version": "v5.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "v5.17.0"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "packageName": "Merge DICOM Toolkit C/C++ 64-bit Microsoft Windows",
          "collectionURL": "https://www.merative.com/merge-imaging/dicom-toolkit",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "MC_XML_To_Message"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-05-03T09:15:07.920",
  "references": [
    {
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-23913",
      "source": "prodsec@nozominetworks.com"
    },
    {
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-23913",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "Use of Out-of-range Pointer Offset vulnerability in Merge DICOM Toolkit C/C++ on Windows.\n\nWhen deprecated MC_XML_To_Message() function is used to read a malformed DICOM XML file, it might result in memory access violation."
    },
    {
      "lang": "es",
      "value": "Uso de la vulnerabilidad de desplazamiento del puntero fuera de rango en Merge DICOM Toolkit C/C++ en Windows. Cuando se utiliza la función obsoleta MC_XML_To_Message() para leer un archivo DICOM XML con formato incorrecto, se puede producir una infracción de acceso a la memoria."
    }
  ],
  "lastModified": "2026-06-17T07:13:52.853",
  "sourceIdentifier": "prodsec@nozominetworks.com"
}