CVE-2026-97059
HighCVSS 8.2Summary
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains.
Risk Assessment
This can trigger heap over-reads, crashing the application or leaking adjacent heap memory. It affects systems processing untrusted DICOM files using DCMTK.
Recommendation
Update DCMTK to a version later than 3.7.0 once a fix is available. Until then, avoid processing untrusted DICOM files or apply additional validation.
Other vulnerabilities in DCMTK
See all- CVE-2026-50003Critical
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
- CVE-2026-10194Medium
A heap-based buffer overflow vulnerability was discovered in DCMTK 3.7.0 in the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages in file dcmqrdb/libsrc/dcmqrdbi.cc. Remote attack is possible. A patch is available with ID 0f78a4ef6f645ea5530166e445e5436a5de58e75.
Original NVD description (English source)
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.