CVE-2026-97059
DCMTK through 3.7.0 Heap Over-read via NumberOfFrames
CVSS Score
8.2
EPSS Score
0.0%
EPSS Percentile
0th
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.
| CWE | CWE-125 |
| Vendor | offis |
| Product | dcmtk |
| Published | Sep 24, 2026 |
| Last Updated | Sep 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for offis dcmtk
Be the first to know when new high vulnerabilities affecting offis dcmtk are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
High
Affected Versions
OFFIS / DCMTK
0 ≤ 3.7.0
References
support.dcmtk.org: https://support.dcmtk.org/redmine/issues/1281 github.com: https://github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285 github.com: https://github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1 github.com: https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L334-L360 github.com: https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L399-L430 github.com: https://github.com/DCMTK/dcmtk vulncheck.com: https://www.vulncheck.com/advisories/dcmtk-through-3.7.0-heap-over-read-via-numberofframes
Credits
Tristan Madani