Heap Over-Read Vulnerability in DCMTK by Offis

CVE-2026-97059

What is CVE-2026-97059?

DCMTK versions up to 3.7.0 contain a heap over-read vulnerability in the ConcatenationLoader module. This vulnerability arises when pixel data frames are copied without proper validation of the PixelData buffer length against the declared NumberOfFrames. Attackers can exploit this flaw by crafting malicious DICOM instances that declare more frames than the actual buffer can handle, potentially leading to application crashes or exposing sensitive adjacent heap memory. It is essential for users of affected versions to apply the provided patches to safeguard their systems.

References