CVE-2026-44037
MediumCVSS 5.5Summary
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values.
Risk Assessment
An attacker can cause a process crash, leading to denial of service for services processing DICOM JSON data.
Recommendation
Update DCMTK to a version containing the fix (commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7).
Other vulnerabilities in DCMTK
See all- CVE-2026-44038Medium
A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries in OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a crafted JPEG stream with a Huffman table defining a difference category above 15.
- CVE-2026-44036Medium
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML file with deeply nested sequence and item elements.
- CVE-2026-44035Medium
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute.
- CVE-2026-50003Critical
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
- CVE-2026-97059High
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains.
- CVE-2026-10194Medium
A heap-based buffer overflow vulnerability was discovered in DCMTK 3.7.0 in the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages in file dcmqrdb/libsrc/dcmqrdbi.cc. Remote attack is possible. A patch is available with ID 0f78a4ef6f645ea5530166e445e5436a5de58e75.
- CVE-2025-14607Medium
A vulnerability was detected in OFFIS DCMTK up to version 3.6.9, affecting the function DcmByteString::makeDicomByteString in the file dcmdata/libsrc/dcbytstr.cc of the dcmdata component. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 resolves the issue.
Original NVD description (English source)
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values. The json2dcm tool and any service that converts untrusted DICOM JSON (for example, DICOMweb payloads) with this reader are affected. The issue is fixed in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS