Astra Linux – vulnerability in dcmtk

A flaw has been identified in OFFIS DCMTK up to version 3.7.0. The affected component is the XMLNode::parseFile function within the ofxml.cc library located at std/libsrc/. Executing any manipulation on this function may result in a heap-based buffer overflow. The attack can be carried out...

Astra Linux – vulnerability in dcmtk

A vulnerability has been identified in OFFIS DCMTK 3.7.0. It affects the DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages function within the dcmqrdb/libsrc/dcmqrdbi.cc file of the dcmqrscp component. Executing a specially crafted manipulation can result in a heap-based buffer overflow. Th...

UBUNTU-CVE-2026-44038

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extendtest and extendoffset tables, causing incorrectly decoded pixel data or a crash, via a DICOM file wit...

UBUNTU-CVE-2026-44036

Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet and DcmXMLParseHelper::parseSequence in the XML-to-DICOM converter dcmdata/libdcxml/xml2dcm.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML file with...

SUSE CVE-2026-44031

Uncontrolled recursion in DcmSequenceOfItems::read and DcmItem::read in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service stack exhaustion and process crash via a DICOM dataset containing deeply nested sequences SQ elements. The datase...

SUSE CVE-2026-44033

Uncontrolled recursion in XMLNode::ParseXMLElement and XMLNode::emptyTheNode in the bundled XML parser ofstd/libsrc/ofxml.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML document with deeply nested elements. The parser i...

SUSE CVE-2026-44034

A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RL...

SUSE CVE-2026-44035

Uncontrolled recursion in DcmDicomDir::moveRecordToTree in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset o...

SUSE CVE-2026-44036

Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet and DcmXMLParseHelper::parseSequence in the XML-to-DICOM converter dcmdata/libdcxml/xml2dcm.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted XML file with...

SUSE CVE-2026-44037

Uncontrolled mutual recursion between DcmJSONReader::parseDataSet, DcmJSONReader::parseElement and DcmJSONReader::parseSequence in dcmdata/libsrc/dcjsonrd.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack exhaustion and process crash via a crafted DICOM JSON document...

SUSE CVE-2026-44038

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extendtest and extendoffset tables, causing incorrectly decoded pixel data or a crash, via a DICOM file wit...

Linux Distros Unpatched Vulnerability : CVE-2026-44035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in DcmDicomDir::moveRecordToTree in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service stack...

Linux Distros Unpatched Vulnerability : CVE-2026-44036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet and DcmXMLParseHelper::parseSequence in the XML-to-DICOM converter...

Linux Distros Unpatched Vulnerability : CVE-2026-44033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in XMLNode::ParseXMLElement and XMLNode::emptyTheNode in the bundled XML parser ofstd/libsrc/ofxml.cc of OFFIS DCMTK 3.7.0 allows an...

Linux Distros Unpatched Vulnerability : CVE-2026-44031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled recursion in DcmSequenceOfItems::read and DcmItem::read in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to...

Linux Distros Unpatched Vulnerability : CVE-2026-44038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries dcmjpeg/libijg8, libijg12 and libijg16 of OFFIS DCMTK 3.7.0 allows an...

Linux Distros Unpatched Vulnerability : CVE-2026-44037

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uncontrolled mutual recursion between DcmJSONReader::parseDataSet, DcmJSONReader::parseElement and DcmJSONReader::parseSequence in dcmdata/libsrc/dcjsonrd.cc of...

Linux Distros Unpatched Vulnerability : CVE-2026-44034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes ...

CVE-2026-44036

A flaw was found in DCMTK's XML-to-DICOM converter. An attacker can exploit this vulnerability by supplying a crafted XML file containing deeply nested elements. When parsed, this input triggers uncontrolled recursion that exhausts stack memory and crashes the application, resulting in a Denial o...

CVE-2026-44034

A flaw was found in DCMTK. A heap-based out-of-bounds read vulnerability occurs in the frame decoding routine due to missing length validation on image data fragments. By enticing a user or application to process a specially crafted Run-Length Encoded RLE DICOM file, an attacker could trigger an...