CVE-2026-44038
MediumCVSS 4.4Summary
A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries in OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a crafted JPEG stream with a Huffman table defining a difference category above 15.
Risk Assessment
An attacker can cause a crash or access out-of-bounds memory, potentially leading to information disclosure or denial of service.
Recommendation
Update DCMTK to a version containing the fix (commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5) or enable DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK.
Other vulnerabilities in DCMTK
See all- CVE-2026-44037Medium
Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement() and DcmJSONReader::parseSequence() in OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOM JSON document with deeply nested sequence (SQ) values.
- CVE-2026-44036Medium
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML file with deeply nested sequence and item elements.
- CVE-2026-44035Medium
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute.
- CVE-2026-50003Critical
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
- CVE-2026-97059High
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains.
- CVE-2026-10194Medium
A heap-based buffer overflow vulnerability was discovered in DCMTK 3.7.0 in the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages in file dcmqrdb/libsrc/dcmqrdbi.cc. Remote attack is possible. A patch is available with ID 0f78a4ef6f645ea5530166e445e5436a5de58e75.
- CVE-2025-14607Medium
A vulnerability was detected in OFFIS DCMTK up to version 3.6.9, affecting the function DcmByteString::makeDicomByteString in the file dcmdata/libsrc/dcbytstr.cc of the dcmdata component. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 resolves the issue.
Original NVD description (English source)
A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a DICOM file with a crafted JPEG stream whose Huffman table defines a difference category above 15. Huffman symbol values are not range-checked unless DCMTK is built with DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK, which is disabled by default. dcmdjpeg and any application that decompresses JPEG DICOM images with DCMTK are affected. The issue is fixed in commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS