A weakness has been identified in OFFIS DCMTK 3.7.0. This affects the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages of the file dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. This patch is called 0f78a4ef6f645ea5530166e445e5436a5de58e75. A patch should be applied to remediate this issue.

An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.

A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.

An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation.

CISA has published an advisory for five vulnerabilities in OFFIS DCMTK (DICOM Toolkit), affecting DCMTK <= 3.7.0:

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01

Fix status:

The fixes are in upstream DCMTK master but not any release as of today https://github.com/DCMTK/dcmtk/releases/tag/latest

Vulnerabilities and fixes:

1. CVE-2026-50003 - bit-preserving C-GET path traversal - CVSS v3.1: 9.8 Critical Fix: eca9a03dd

A victim DCMTK C-GET client connects to a malicious or compromised DICOM server while using bit-preserving storage mode (getscu --bit-preserving / DCMSCUSTORAGEBITPRESERVING). During the C-GET response, the server supplies an affected SOP Instance UID containing path separators or an absolute path. DcmSCU::handleCGETSession() used that value to build the output path without the filename sanitization used by the normal disk-storage path. The result is file creation/truncation outside the selected output directory, limited to paths writable by the client process and to directories that already exist.

2. CVE-2026-50254 - Extended Negotiation memory leak - CVSS v3.1: 7.5 High Fix: 23f181f7a

An unauthenticated client repeatedly opens a DICOM association and sends an A-ASSOCIATE-RQ containing many Extended Negotiation items followed by a malformed/truncated Extended Negotiation item. The parser error path frees the list container but not the allocated negotiation items. In storescp default single-process mode, repeated connections cause RSS growth until the process is killed or stops accepting DICOM connections.

3. CVE-2026-35505 - connection error-path memory leaks - CVSS v3.1: 7.5 High Fix: 2312891a8

An unauthenticated client sends an A-ASSOCIATE-RQ where presentation-context structures are parsed and allocated, then a later presentation context triggers a translation failure, for example by containing no transfer syntaxes. The server returns before freeing the parsed PDU graph. Repeating this request leaks memory in single-process services. There is also an analogous SCU-side error path when a long-running DCMTK client parses a malformed A-ASSOCIATE-AC from a rogue server.

4. CVE-2026-52868 - Called AE Title path traversal in wlmscpfs - CVSS v3.1: 8.2 High Fix: e3878daf8

An unauthenticated client connects to wlmscpfs with a Called AE Title containing a short traversal sequence. wlmscpfs used the Called AE Title to construct worklist storage and lockfile paths without a containment check. If the resolved directory exists, has the expected lockfile, and contains matching .wl worklist files, a normal C-FIND query can return records outside the intended per-AE storage area. This is not arbitrary OS file read; disclosure is limited to reachable worklist records within the 16-byte AE Title naming constraint. With non-default --request-file-path logging and AE Title/Patient ID placeholders, the same unsanitized values could also produce a constrained write outside the request-file directory.

5. CVE-2026-44628 - VR-spoofing type confusion in wlmscpfs - CVSS v3.1: 7.5 High Fixes: f4e007468 and 694a0a06a

An unauthenticated client negotiates Explicit VR and sends a C-FIND request containing a dictionary sequence tag encoded on the wire with a non-sequence VR. DCMTK constructs a non-sequence object, but wlmscpfs later casts the result to DcmSequenceOfItems without checking the actual type. If the query reaches a valid worklist directory with an expected lockfile and a matching record, the wrong-type use crashes the process. In single-process mode this stops the service; in default fork mode the child crashes and the parent continues serving.

Potential exposure includes patient worklist metadata in affected wlmscpfs deployments, file write outside an intended C-GET output directory, and availability loss for DICOM worklist/storage services through crash or OOM.

Coordination timeline:

2026-05-11 Reported to OFFIS DCMTK maintainers 2026-05-12 First fix committed upstream 2026-05-14 CERT/CC case opened as VU#470252 2026-05-29 Remaining fixes committed upstream 2026-06-30 CISA advisory published as ICSMA-26-181-01

Mitigation notes:

Apply the upstream fixes or the rolling latest snapshot when possible. Keep DICOM services on trusted networks only. For DoS exposure, prefer multi-process/fork mode where available. Avoid getscu --bit-preserving / DCMSCUSTORAGEBITPRESERVING with untrusted C-GET servers until patched.

Additional background:

https://www.healthcareinfosecurity.com/dicom-toolkit-bugs-raise-medical-imaging-security-risks-a-32114

Credit:

Reported by Abhinav Agarwal.

A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a manipulation can lead to heap-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. This patch is called 1d4b3815c0987840a983160bfc671fef63a3105b. It is best practice to apply a patch to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

A vulnerability was found in DCMTK 3.6.9. It has been declared as critical. This vulnerability affects unknown code of the component dcmjpls JPEG-LS Decoder. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3239a7915. It is recommended to apply a patch to fix this issue.

A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DICOM file.

DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h.

A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file.

(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and (8) dcmqrdb/apps/dcmqrscp.cc in DCMTK 3.6.1 and earlier does not check the return value of the setuid system call, which allows local users to gain privileges by creating a large number of processes.

A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file dcmnet/apps/storescp.cc of the component storescp. Performing a manipulation results in os command injection. Remote exploitation of the attack is possible. The patch is named edbb085e45788dccaf0e64d71534cfca925784b8. Applying a patch is the recommended action to fix this issue.

A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIndexDatabaseHandle::startMoveRequest in the library dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. This manipulation causes null pointer dereference. The attack requires local access. Upgrading to version 3.7.0 is sufficient to resolve this issue. Patch name: ffb1a4a37d2c876e3feeb31df4930f2aed7fa030. You should upgrade the affected component.

A vulnerability was detected in OFFIS DCMTK up to 3.6.9. Affected by this issue is the function DcmByteString::makeDicomByteString of the file dcmdata/libsrc/dcbytstr.cc of the component dcmdata. The manipulation results in memory corruption. The attack can be launched remotely. Upgrading to version 3.7.0 can resolve this issue. The patch is identified as 4c0e5c10079392c594d6a7abd95dd78ac0aa556a. You should upgrade the affected component.

An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOIPList::createFromImage functionality of OFFIS DCMTK 3.6.8. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.

An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.

dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.

dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message.

DCMTK v3.6.7 was discovered to contain a memory leak via the TASCAssociation object.

Last updated 17 September 2024

DCMTK through 3.6.6 does not handle memory free properly. The object in the program is free but its address is still used in other locations. Sending specific requests to the dcmqrdb program will incur a double free. An attacker can use it to launch a DoS attack.

DCMTK through 3.6.6 does not handle string copy properly. Sending specific requests to the dcmqrdb program, it would query its database and copy the result even if the result is null, which can incur a head-based overflow. An attacker can use it to launch a DoS attack.

DCMTK through 3.6.6 does not handle memory free properly. The malloced memory for storing all file information are recorded in a global variable LST and are not freed properly. Sending specific requests to the dcmqrdb program can incur a memory leak. An attacker can use it to launch a DoS attack.

DCMTK through 3.6.6 does not handle memory free properly. The program malloc a heap memory for parsing data, but does not free it when error in parsing. Sending specific requests to the dcmqrdb program incur the memory leak. An attacker can use it to launch a DoS attack.

Last updated 24 July 2024

Last updated 24 July 2024

A security vulnerability has been detected in DCMTK up to 3.6.5. The affected element is the function parseQuota of the component dcmqrscp. The manipulation of the argument StorageQuota leads to stack-based buffer overflow. Local access is required to approach this attack. The exploit has been disclosed publicly and may be used. Upgrading to version 3.6.6 is sufficient to fix this issue. The identifier of the patch is 0fef9f02e. It is recommended to upgrade the affected component.