CVE-2026-44038: Global buffer out-of-bounds read in DCMTK JPEG Huffman decoding
A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extendtest[] and extendoffset[] tables, causing incorrectly decoded pixel data or a crash, via a DICOM file with a crafted JPEG stream whose Huffman table defines a difference category above 15. Huffman symbol values are not range-checked unless DCMTK is built with DCMTKENABLESTRICTHUFFMANTABLECHECK, which is disabled by default. dcmdjpeg and any application that decompresses JPEG DICOM images with DCMTK are affected. The issue is fixed in commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OFFIS DCMTKto a version that resolves this vulnerability.Patch d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5 - Configuration
Build DCMTK with DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK enabled so Huffman symbol values are range-checked.
DCMTK JPEG Huffman decoder DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK = enabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
DCMTK 3.7.0 deployments using dcmdjpeg or applications that decompress JPEG-compressed DICOM images through DCMTK are affected. The vulnerable JPEG code is in the bundled IJG libraries dcmjpeg/libijg8, libijg12, and libijg16.
What must an attacker provide to trigger the flaw?
An attacker must cause the affected software to process a DICOM file containing a crafted JPEG stream. The stream's Huffman table defines a difference category greater than 15, which can cause reads beyond the extend_test[] and extend_offset[] tables.
Are default builds affected?
Yes. Huffman symbol values are not range-checked unless DCMTK is built with DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK, and that option is disabled by default.
What can be done if the code cannot be updated immediately?
Rebuild DCMTK with DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK enabled to apply Huffman symbol range checking. Also avoid processing untrusted JPEG-compressed DICOM files where operationally possible.
What are the observed effects of successful triggering?
Processing the crafted image can produce incorrectly decoded pixel data or crash the affected application. The out-of-bounds read is global and occurs beyond the JPEG decoder's extend_test[] and extend_offset[] tables.