CVE-2026-50003
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
Risk Assessment
The risk involves potential overwriting or creation of files in arbitrary filesystem locations, which could lead to data integrity compromise, privilege escalation, or further system compromise.
Recommendation
Update the DCMTK library to a version that includes a fix preventing file writes outside the allowed output directory and implement path validation on the client side.
Other vulnerabilities in DCMTK
See all- CVE-2026-97059High
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains.
- CVE-2026-10194Medium
A heap-based buffer overflow vulnerability was discovered in DCMTK 3.7.0 in the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages in file dcmqrdb/libsrc/dcmqrdbi.cc. Remote attack is possible. A patch is available with ID 0f78a4ef6f645ea5530166e445e5436a5de58e75.
Original NVD description (English source)
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS