Linux Distros Unpatched Vulnerability : CVE-2026-97059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length...

SUSE CVE-2026-97059

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059

A flaw was found in DCMTK. This heap over-read vulnerability exists in the ConcatenationLoader component, where it copies pixel data frames without properly validating the buffer length against the declared number of frames. A remote attacker could exploit this by crafting malicious Digital Imagi...

CVE-2026-97059

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

DEBIAN-CVE-2026-97059

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

UBUNTU-CVE-2026-97059

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059 DCMTK through 3.7.0 Heap Over-read via NumberOfFrames

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059

Versions of DCMTK through 3.7.0 are vulnerable to a heap over-read in the ConcatenationLoader component. The root cause is a failure to validate the PixelData buffer length against the declared NumberOfFrames when copying pixel data frames. Attackers can exploit this by crafting malicious DICOM i...

CVE-2026-97059 DCMTK through 3.7.0 Heap Over-read via NumberOfFrames

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

EUVD-2026-85885

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059 DCMTK through 3.7.0 Heap Over-read via NumberOfFrames

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

CVE-2026-97059: Out-of-bounds Read

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to...

PT-2026-97802

Name of the Vulnerable Software and Affected Versions DCMTK versions prior to 3.7.1 Description A heap over-read occurs in the ConcatenationLoader when copying pixel data frames. The issue arises because the software fails to validate the PixelData buffer length against the declared NumberOfFrame...

Astra Linux – Vulnerability in dcmtk

The service class user SCU of OFFIS DCMTK all versions prior to 3.6.7 is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could enable remote code execution...

Astra Linux – Vulnerability in dcmtk

OFFIS DCMTK’s all versions prior to 3.6.7 has a NULL pointer dereference vulnerability when processing DICOM files, which may lead to a denial-of-service condition...

CVE-2026-35505

A flaw was found in DCMTK. An unauthenticated remote attacker can repeatedly send specially crafted connection requests, leading to a memory leak. This memory growth can cause the service to become unresponsive and terminate, resulting in a Denial of Service DoS for single-process deployments...

CVE-2026-52868

A flaw was found in DCMTK. An unauthenticated attacker can read sensitive worklist records from a directory outside the intended storage area. This could lead to unauthorized information disclosure, potentially crossing departmental or clinic data separation in multi-area deployments...

CVE-2026-50254

A flaw was found in DCMTK. An unauthenticated remote attacker can exploit this vulnerability by repeatedly sending a single crafted connection request. This can lead to memory leakage, causing the service to eventually terminate and stop accepting new connections, resulting in a Denial of Service...