CVE-2026-97059: DCMTK through 3.7.0 Heap Over-read via NumberOfFrames
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to exploit this issue?
An attacker needs to provide a malicious DICOM instance that declares a NumberOfFrames value larger than the available PixelData buffer. The vulnerable ConcatenationLoader must process that instance.
What impact should responders expect?
Processing the crafted DICOM data can cause a heap over-read. This may crash the application or disclose adjacent heap memory.
Which deployments are affected?
DCMTK versions through 3.7.0 are affected, specifically where ConcatenationLoader processes attacker-controlled or otherwise untrusted DICOM instances.