EUVD-2026-94941

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extendtest and extendoffset tables, causing incorrectly decoded pixel data or a crash, via a DICOM file wit...

CVE-2026-44037 Uncontrolled recursion in DCMTK JSON reader allows denial of service

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet, DcmJSONReader::parseElement and DcmJSONReader::parseSequence in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOM JSON document...

CVE-2026-44037 Uncontrolled recursion in DCMTK JSON reader allows denial of service

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet, DcmJSONReader::parseElement and DcmJSONReader::parseSequence in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOM JSON document...

CVE-2026-44037

The OFFIS DCMTK 3.7.0 library is vulnerable to a denial of service (stack exhaustion and process crash) due to uncontrolled mutual recursion between the functions DcmJSONReader::parseDataSet(), DcmJSONReader::parseElement(), and DcmJSONReader::parseSequence() located in dcmdata/libsrc/dcjsonrd.cc...

EUVD-2026-94940

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet, DcmJSONReader::parseElement and DcmJSONReader::parseSequence in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOM JSON document...

CVE-2026-44036 Uncontrolled recursion in DCMTK xml2dcm allows denial of service

Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet and DcmXMLParseHelper::parseSequence in the XML-to-DICOM converter dcmdata/libdcxml/xml2dcm.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML file with...

CVE-2026-44036 Uncontrolled recursion in DCMTK xml2dcm allows denial of service

Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet and DcmXMLParseHelper::parseSequence in the XML-to-DICOM converter dcmdata/libdcxml/xml2dcm.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML file with...

CVE-2026-44036

The OFFIS DCMTK 3.7.0 library is vulnerable to a denial of service (DoS) due to uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() within the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc ). An attacker can trigger a stack exhausti...

EUVD-2026-94939

Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet and DcmXMLParseHelper::parseSequence in the XML-to-DICOM converter dcmdata/libdcxml/xml2dcm.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML file with...

CVE-2026-44035 Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service

Uncontrolled recursion in DcmDicomDir::moveRecordToTree in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset o...

CVE-2026-44035 Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service

Uncontrolled recursion in DcmDicomDir::moveRecordToTree in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset o...

CVE-2026-44035

The OFFIS DCMTK 3.7.0 software is vulnerable to a denial of service (stack exhaustion and process crash) due to uncontrolled recursion in the DcmDicomDir::moveRecordToTree() function located in dcmdata/libsrc/dcdicdir.cc. An attacker can trigger this by providing a crafted DICOMDIR file containin...

EUVD-2026-94938

Uncontrolled recursion in DcmDicomDir::moveRecordToTree in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset o...

CVE-2026-44034

A heap-based out-of-bounds read vulnerability exists in OFFIS DCMTK 3.7.0 within the DcmRLECodecDecoder::decodeFrame() function located in dcmdata/libsrc/dcrleccd.cc. An attacker can provide a crafted RLE Lossless DICOM file with a pixel data fragment shorter than the 64-byte RLE header, causing ...

CVE-2026-44034 Heap out-of-bounds read in DCMTK RLE decodeFrame()

A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RL...

CVE-2026-44034 Heap out-of-bounds read in DCMTK RLE decodeFrame()

A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RL...

EUVD-2026-94937

A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RL...

CVE-2026-44033 Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service

Uncontrolled recursion in XMLNode::ParseXMLElement and XMLNode::emptyTheNode in the bundled XML parser ofstd/libsrc/ofxml.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML document with deeply nested elements. The parser i...

CVE-2026-44033 Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service

Uncontrolled recursion in XMLNode::ParseXMLElement and XMLNode::emptyTheNode in the bundled XML parser ofstd/libsrc/ofxml.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML document with deeply nested elements. The parser i...

CVE-2026-44033

The bundled XML parser in OFFIS DCMTK 3.7.0 (specifically ofstd/libsrc/ofxml.cc) contains an uncontrolled recursion vulnerability within the XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() functions. An attacker can trigger a denial of service (stack exhaustion and process crash) by provid...