Memory Leak Vulnerability in DCMTK by Offis
CVE-2026-35505

8.7HIGH

Key Information:

Vendor: Offis Dicom
Status: Dcmtk Toolkit
Vendor: CVE Published:; 30 June 2026

🔔 Create Offis Dicom Vulnerability Alert

What is CVE-2026-35505?

An unauthenticated remote attacker can exploit a memory leak vulnerability in DCMTK software by sending specially crafted connection requests. In affected single-process deployments, this may lead to increasing memory usage until the service becomes unresponsive, prompting a restart to regain functionality. This vulnerability could significantly impact service availability and the overall performance of systems using DCMTK.

Affected Version(s)

DCMTK Toolkit 0 <= 3.7.0

References

https://github.com/DCMTK/dcmtk/releases/tag/latest

https://www.cisa.gov/news-events/ics-medical-advisories/i...

https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:

8.7

Severity:

HIGH

Confidentiality:

None

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 30, 2026
Vulnerability Reserved
Jun 22, 2026

Credit

Abhinav Agarwal reported this vulnerability to CISA.

CVE-2026-35505 Data

JSON