Denial of Service Vulnerability in OFFIS DCMTK's DcmSequenceOfItems and DcmItem Libraries
CVE-2026-44031

8.7HIGH

Key Information:

Vendor

Offis

Status
Dcmtk
Vendor
CVE Published:
8 October 2026

What is CVE-2026-44031?

The dcmdata library in OFFIS DCMTK 3.7.0 is susceptible to an unchecked recursion issue, specifically in the methods DcmSequenceOfItems::read() and DcmItem::read(). This vulnerability allows an unauthenticated remote attacker to induce a denial of service condition by sending a maliciously crafted DICOM dataset featuring deeply nested sequences. The parsing of this dataset occurs prior to authentication, making it a serious risk for DICOM services such as storescp, dcmrecv, and dcmqrscp built on DCMTK. This not only leads to stack exhaustion and subsequent process crashes, but it also affects local tools like dcmdump, which fail when attempting to open such datasets. The problem has been addressed in a recent patch that introduces a configurable limit on the sequence nesting depth, enhancing the resilience of the affected libraries.

Affected Version(s)

DCMTK 3.7.0

References

https://support.dcmtk.org/redmine/issues/1191
issue-trackingvendor-advisory
https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arjun Basnet from Securin
.