CVE-2025-14841

Executive Summary

CVE-2025-14841 is a null pointer dereference vulnerability in OFFIS DCMTK, a widely used DICOM toolkit. The flaw resides in the dcmqrscp component, specifically within the DcmQueryRetrieveIndexDatabaseHandle::startFindRequest and DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest functions in dcmqrdb/libsrc/dcmqrdbi.cc. An attacker with local access can trigger a null pointer dereference, leading to a denial of service (DoS) condition. The vulnerability affects versions up to 3.6.9. The official patch is included in version 3.7.0, with a specific commit hash ffb1a4a37d2c876e3feeb31df4930f2aed7fa030. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the OFFIS DCMTK C++ library, which is typically compiled from source or distributed as a system package. Organizations using DCMTK in medical imaging applications should verify their version and apply the patch.

CVSS Breakdown & Threat Level

• CVSS Score: 3.3 (Low)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: Low (A:L) – The service may crash or become unresponsive.

Threat Level: Low. The requirement for local access significantly reduces the attack surface. However, in environments where untrusted users have local access to DICOM servers, this could be exploited to cause service disruption.

Deep Dive & Mechanics

The vulnerability is a null pointer dereference in the DCMTK DICOM Query/Retrieve Service Class Provider (dcmqrscp). The functions DcmQueryRetrieveIndexDatabaseHandle::startFindRequest and DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest are responsible for handling C-FIND and C-MOVE requests, respectively. When processing certain malformed or unexpected DICOM messages, the code fails to properly validate a pointer before dereferencing it, leading to a crash.

The root cause is insufficient input validation in the database handle logic. Specifically, when the database index handle is not properly initialized or when a query contains invalid parameters, the code attempts to use a null pointer, causing a segmentation fault. This can be triggered by sending a crafted DICOM request to the dcmqrscp service.

The patch in version 3.7.0 (commit ffb1a4a37d2c876e3feeb31df4930f2aed7fa030) adds null pointer checks before dereferencing the pointer, preventing the crash.

Vulnerable vs. Patched Code

The vulnerable code in dcmqrdb/libsrc/dcmqrdbi.cc likely looks like this (simplified):

// Vulnerable version (before patch)
OFCondition DcmQueryRetrieveIndexDatabaseHandle::startFindRequest(
    T_ASC_Association *assoc, T_DIMSE_Message *msg, T_ASC_PresentationContextID presID)
{
    // ... some code ...
    DcmDataset *statusDetail = NULL;
    // Missing null check before dereference
    if (statusDetail->isEmpty()) {  // Null pointer dereference here
        // ...
    }
    // ...
}

The patched version adds a null check:

// Patched version (after commit ffb1a4a37d2c876e3feeb31df4930f2aed7fa030)
OFCondition DcmQueryRetrieveIndexDatabaseHandle::startFindRequest(
    T_ASC_Association *assoc, T_DIMSE_Message *msg, T_ASC_PresentationContextID presID)
{
    // ... some code ...
    DcmDataset *statusDetail = NULL;
    if (statusDetail != NULL) {  // Added null check
        if (statusDetail->isEmpty()) {
            // ...
        }
    }
    // ...
}

The exact diff may vary, but the core fix is adding a null pointer validation before using the pointer.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Since no public exploit code is available, a red team can simulate the attack by crafting a malformed DICOM C-FIND or C-MOVE request. The following Python script using the pynetdicom library can be used to trigger the vulnerability:

#!/usr/bin/env python3
# Red Team: Trigger CVE-2025-14841 null pointer dereference
# Requires: pynetdicom (pip install pynetdicom)

from pynetdicom import AE, evt, debug_logger
from pynetdicom.sop_class import PatientRootQueryRetrieveInformationModelFind
from pydicom.dataset import Dataset

# Enable debug logging
debug_logger()

# Create Application Entity
ae = AE(ae_title=b'ATTACKER')

# Add requested context
ae.add_requested_context(PatientRootQueryRetrieveInformationModelFind)

# Create a malformed query dataset
ds = Dataset()
ds.PatientName = '*'  # Valid query
# Intentionally omit required fields or add invalid data to trigger null pointer
# For example, set a tag to None or invalid value
# ds.add_new(0x00100010, 'PN', None)  # This might cause issues

# Associate with the target DICOM server
assoc = ae.associate('127.0.0.1', 11112, ae_title=b'ANY-SCP')

if assoc.is_established:
    # Send C-FIND request
    responses = assoc.send_c_find(ds, PatientRootQueryRetrieveInformationModelFind)
    for (status, identifier) in responses:
        if status:
            print('C-FIND response status: 0x{0:04x}'.format(status.Status))
        else:
            print('Connection timed out, no response received')
    assoc.release()
else:
    print('Association rejected or aborted')

Note: This script may not trigger the vulnerability if the server has proper input validation. The exact malformed input required is not publicly documented.

Blue Team (Defense & Detection)

To detect exploitation attempts:

1. Monitor DICOM service logs for crashes or segmentation faults in dcmqrscp.
2. Use network monitoring to detect malformed DICOM messages.
3. Implement rate limiting on DICOM C-FIND/C-MOVE requests.
4. Restrict local access to the DICOM server to trusted users only.

Indicators of Compromise (IOCs)

• Network: DICOM C-FIND or C-MOVE requests with unusual or missing fields.
• System: Segmentation faults or crashes in the dcmqrscp process.
• Logs: Entries indicating null pointer dereference or SIGSEGV signals.
• File: Core dumps from dcmqrscp crashes.

Detection Engineering

YARA Rule

rule CVE_2025_14841_DCMTK_Null_Pointer_Dereference {
    meta:
        description = "Detects DCMTK dcmqrscp binary with vulnerable null pointer dereference"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14841"
        hash = "ffb1a4a37d2c876e3feeb31df4930f2aed7fa030"
    strings:
        $vuln_func1 = "startFindRequest"
        $vuln_func2 = "startMoveRequest"
        $null_check = "statusDetail != NULL"
    condition:
        (uint16(0) == 0x457f or uint32(0) == 0x464c457f) and // ELF magic
        ($vuln_func1 or $vuln_func2) and
        not $null_check
}

Sigma Rule

title: DCMTK dcmqrscp Null Pointer Dereference
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects crashes or segmentation faults in DCMTK dcmqrscp service
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14841
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/dcmqrscp'
        CommandLine|contains: 'segfault'
    condition: selection
falsepositives:
    - Legitimate crashes due to other reasons
level: medium

Suricata Rule

alert tcp any any -> any 11112 (msg:"CVE-2025-14841 DCMTK dcmqrscp Null Pointer Dereference Attempt"; flow:to_server,established; content:"|01 00 00 00|"; depth:4; content:"|00 00 00 00|"; within:4; reference:cve,2025-14841; classtype:attempted-dos; sid:1000001; rev:1;)

Note: The Suricata rule above is a generic example. A more precise rule would require deep packet inspection of DICOM messages, which is complex due to the protocol's variability.

Remediation & Mitigation

1. Upgrade DCMTK to version 3.7.0 or later. The patch commit is ffb1a4a37d2c876e3feeb31df4930f2aed7fa030.
2. Apply the patch manually if upgrading is not immediately possible. Download the patch from the OFFIS DCMTK repository and rebuild the affected component.
3. Restrict local access to the DICOM server to only trusted users and processes.
4. Monitor logs for crashes or unusual DICOM requests.
5. Use a firewall to limit access to port 11112 (DICOM default) to authorized IP addresses only.
6. Implement input validation at the application layer to reject malformed DICOM messages.

Valters IT
Securing Digital Infrastructures