CVE-2026-44031

Summary

A remote attacker can trigger stack exhaustion and process crashes in OFFIS DCMTK 3.7.0 by sending a DICOM dataset with deeply nested sequences, causing denial of service without authentication. This affects DICOM services like storescp, dcmrecv, and dcmqrscp, as well as local tools like dcmdump.

Exploitability

Exploitation is straightforward with no authentication required, needing only a specially crafted DICOM dataset with deeply nested sequences to be sent to any affected DICOM service or tool.

Blast radius

The impact is significant across healthcare systems using DCMTK-based DICOM services, potentially causing widespread denial of service in medical imaging workflows and data handling processes.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to OFFIS DCMTK version 3.7.1 or later, which includes the fix for uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read().

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.