{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44035", "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "state": "PUBLISHED", "assignerShortName": "securin", "dateReserved": "2026-05-05T02:49:00.667Z", "datePublished": "2026-10-08T12:55:10.263Z", "dateUpdated": "2026-10-08T14:09:00.382Z"}, "containers": {"cna": {"title": "Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service", "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f."}], "affected": [{"vendor": "OFFIS", "product": "DCMTK", "collectionURL": "https://github.com/DCMTK/dcmtk", "repo": "https://github.com/DCMTK/dcmtk", "modules": ["dcmdata"], "programFiles": ["dcmdata/libsrc/dcdicdir.cc"], "cpes": ["cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.7.0", "status": "affected"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "baseScore": 6.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM"}}], "solutions": [{"lang": "en", "value": "Update to a DCMTK version that contains commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f. As of the publication date, no tagged release after DCMTK 3.7.0 includes this fix, so apply the commit or build from the current master branch."}], "references": [{"url": "https://support.dcmtk.org/redmine/issues/1215", "name": "DCMTK issue #1215", "tags": ["issue-tracking", "vendor-advisory"]}, {"url": "https://github.com/DCMTK/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f", "name": "Fix commit", "tags": ["patch"]}], "credits": [{"lang": "en", "value": "Arjun Basnet from Securin", "type": "finder"}], "timeline": [{"time": "2026-05-25T00:00:00.000Z", "lang": "en", "value": "CVE ID shared with the vendor"}, {"time": "2026-05-25T00:00:00.000Z", "lang": "en", "value": "Fix committed by the vendor"}, {"time": "2026-06-19T00:00:00.000Z", "lang": "en", "value": "Vendor approved publication"}], "source": {"discovery": "EXTERNAL"}, "providerMetadata": {"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "shortName": "securin", "dateUpdated": "2026-10-08T12:55:10.263Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-08T14:08:51.179526Z", "id": "CVE-2026-44035", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T14:09:00.382Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44035", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-08T14:08:51.179526Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-08T14:08:55.352Z"}}], "cna": {"title": "Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Arjun Basnet from Securin"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*"], "repo": "https://github.com/DCMTK/dcmtk", "vendor": "OFFIS", "modules": ["dcmdata"], "product": "DCMTK", "versions": [{"status": "affected", "version": "3.7.0"}], "programFiles": ["dcmdata/libsrc/dcdicdir.cc"], "collectionURL": "https://github.com/DCMTK/dcmtk", "defaultStatus": "unknown"}], "timeline": [{"lang": "en", "time": "2026-05-25T00:00:00.000Z", "value": "CVE ID shared with the vendor"}, {"lang": "en", "time": "2026-05-25T00:00:00.000Z", "value": "Fix committed by the vendor"}, {"lang": "en", "time": "2026-06-19T00:00:00.000Z", "value": "Vendor approved publication"}], "solutions": [{"lang": "en", "value": "Update to a DCMTK version that contains commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f. As of the publication date, no tagged release after DCMTK 3.7.0 includes this fix, so apply the commit or build from the current master branch."}], "references": [{"url": "https://support.dcmtk.org/redmine/issues/1215", "name": "DCMTK issue #1215", "tags": ["issue-tracking", "vendor-advisory"]}, {"url": "https://github.com/DCMTK/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f", "name": "Fix commit", "tags": ["patch"]}], "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-674", "description": "CWE-674 Uncontrolled Recursion"}]}], "providerMetadata": {"orgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "shortName": "securin", "dateUpdated": "2026-10-08T12:55:10.263Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44035", "state": "PUBLISHED", "dateUpdated": "2026-10-08T14:09:00.382Z", "dateReserved": "2026-05-05T02:49:00.667Z", "assignerOrgId": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "datePublished": "2026-10-08T12:55:10.263Z", "assignerShortName": "securin"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/DCMTK/dcmtk", "cpes": ["cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "modules": ["dcmdata"], "product": "DCMTK", "programFiles": ["dcmdata/libsrc/dcdicdir.cc"], "repo": "https://github.com/DCMTK/dcmtk", "vendor": "OFFIS", "versions": [{"status": "affected", "version": "3.7.0"}]}], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f."}], "id": "CVE-2026-44035", "lastModified": "2026-10-08T21:10:00.133", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44035", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-08T14:08:51.179526Z", "version": "2.0.3"}}]}, "published": "2026-10-08T13:17:17.497", "references": [{"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "url": "https://github.com/DCMTK/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f"}, {"source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "url": "https://support.dcmtk.org/redmine/issues/1215"}], "sourceIdentifier": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-674"}], "source": "33c584b5-0579-4c06-b2a0-8d8329fcab9c", "type": "Secondary"}]}

{"bugzilla": {"description": "dcmtk: dcmtk: Denial of Service via uncontrolled recursion in DICOMDIR processing", "id": "2547948", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547948"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["A flaw was found in DCMTK. An attacker could exploit this vulnerability by enticing a user or service to process a specially crafted DICOM directory (DICOMDIR) file containing deeply nested directory records. This issue triggers uncontrolled recursion during record processing, causing stack memory exhaustion that crashes the application and results in a Denial of Service (DoS)."], "name": "CVE-2026-44035", "public_date": "2026-10-08T12:55:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-44035\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44035\nhttps://github.com/DCMTK/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f\nhttps://support.dcmtk.org/redmine/issues/1215"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires local user interaction to process an untrusted DICOMDIR file, limiting the blast radius to a process crash without compromising system integrity or confidentiality. The affected dcmtk package is not included in supported Red Hat Enterprise Linux releases and is only distributed through community repositories such as Fedora and EPEL. Consequently, default Red Hat enterprise environments are not exposed to this flaw.", "threat_severity": "Moderate"}