Skip to content
OpenAdvisories
Critical ICSMA-26-181-01 5 CVEs

OFFIS DCMTK Toolkit

Published Jun 30, 2026 · Updated Jun 30, 2026

Vendor: OFFIS Product: DCMTK

Summary

Successful exploitation of these vulnerabilities could allow an attacker to write files, access unauthorized information, exhaust memory, or crash affected DCMTK client or server processes.

Vulnerabilities 5

  • Critical 9.8
    CVE-2026-50003

    OFFIS DCMTK Toolkit Path Traversal

    A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.

    OFFIS DICOM DCMTK Toolkit dcmtk dcmtk Debian Ubuntu
  • High 8.2
    CVE-2026-52868

    OFFIS DCMTK Toolkit Path Traversal

    An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation.

    OFFIS DICOM DCMTK Toolkit dcmtk dcmtk Debian Ubuntu
  • High 7.5
    CVE-2026-35505

    OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime

    An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.

    OFFIS DICOM DCMTK Toolkit dcmtk dcmtk Debian Ubuntu
  • High 7.5
    CVE-2026-44628

    OFFIS DCMTK Toolkit Type Confusion

    An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.

    OFFIS DICOM DCMTK Toolkit dcmtk dcmtk Debian Ubuntu
  • High 7.5
    CVE-2026-50254

    OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime

    An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connectio…

    OFFIS DICOM DCMTK Toolkit dcmtk dcmtk Debian Ubuntu

Revision history

  1. #1

    Initial Publication

References