CVE-2026-44035

MEDIUM 5.5

Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service

CVSS Score

5.5

EPSS Score

0.0%

EPSS Percentile

0th

Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f.

CWE	CWE-674
Vendor	offis
Product	dcmtk
Published	Oct 8, 2026

Stay Ahead of the Next One

Get instant alerts for offis dcmtk

Be the first to know when new medium vulnerabilities affecting offis dcmtk are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

OFFIS / DCMTK

3.7.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

support.dcmtk.org: https://support.dcmtk.org/redmine/issues/1215 github.com: https://github.com/DCMTK/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f

Credits

Arjun Basnet from Securin