CVE-2026-97059 | BDVDB-2026-378901 Detail
OFFISDCMTK
Description#
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact high. Attack vector: network.
Weaknesses#
- CWE-125 Out-of-bounds Read
References#
- https://support.dcmtk.org/redmine/issues/1281
- https://github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285
- https://github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1
- https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L334-L360
- https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L399-L430
- https://github.com/DCMTK/dcmtk
- https://www.vulncheck.com/advisories/dcmtk-through-3.7.0-heap-over-read-via-numberofframes
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.