« Volver al listado

CVE-2024-23914

Estado: AplazadaMedia (5.7)—

Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows.

When MC_Open_Association() function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it might result in an unhandled exception.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Merge — Dicom ToolkitAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-23914",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-23914",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-03T14:28:49.877832Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "prodsec@nozominetworks.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.7,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.1
      }
    ]
  },
  "affected": [
    {
      "source": "prodsec@nozominetworks.com",
      "affectedData": [
        {
          "vendor": "Merative",
          "product": "Merge DICOM Toolkit C/C++",
          "versions": [
            {
              "status": "affected",
              "version": "v5.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "v5.17.0"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "packageName": "Merge DICOM Toolkit C/C++ 64-bit Microsoft Windows",
          "collectionURL": "https://www.merative.com/merge-imaging/dicom-toolkit",
          "defaultStatus": "unaffected",
          "programRoutines": [
            {
              "name": "MC_Open_Association"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:merative:merge_dicom_toolkit_c_c\\+\\+:5.6.0:*:*:*:*:*:*:*"
          ],
          "vendor": "merative",
          "product": "merge_dicom_toolkit_c_c\\+\\+",
          "versions": [
            {
              "status": "affected",
              "version": "5.6.0",
              "versionType": "semver",
              "lessThanOrEqual": "5.17.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-03T09:15:08.090",
  "references": [
    {
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-23914",
      "source": "prodsec@nozominetworks.com"
    },
    {
      "url": "https://www.nozominetworks.com/labs/vulnerability-advisories-cve-2024-23914",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "prodsec@nozominetworks.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-134"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Use of Externally-Controlled Format String vulnerability in Merge DICOM Toolkit C/C++ on Windows.\n\nWhen MC_Open_Association() function is used to open DICOM Association and gets DICOM Application Context Name with illegal characters, it might result in an unhandled exception."
    },
    {
      "lang": "es",
      "value": "Uso de la vulnerabilidad de cadena de formato controlada externamente en Merge DICOM Toolkit C/C++ en Windows. Cuando se utiliza la función MC_Open_Association() para abrir la Asociación DICOM y obtiene el Nombre de contexto de la aplicación DICOM con caracteres ilegales, puede resultar en una excepción no controlada."
    }
  ],
  "lastModified": "2026-06-17T07:13:52.957",
  "sourceIdentifier": "prodsec@nozominetworks.com"
}