CVE-2026-10194 in DCMTK
Summary
by MITRE • 05/31/2026
A weakness has been identified in OFFIS DCMTK 3.7.0. This affects the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages of the file dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. This patch is called 0f78a4ef6f645ea5530166e445e5436a5de58e75. A patch should be applied to remediate this issue.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/02/2026
The vulnerability identified in OFFIS DCMTK 3.7.0 represents a critical heap-based buffer overflow within the DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages function. This flaw exists in the dcmqrdb/libsrc/dcmqrdbi.cc file of the dcmqrscp component, which is part of the DICOM (Digital Imaging and Communications in Medicine) toolkit used extensively in healthcare environments for medical image management and transmission. The vulnerability arises from inadequate input validation and memory management practices when processing database operations related to image deletion, creating a scenario where maliciously crafted inputs can trigger unauthorized memory access patterns.
The technical implementation of this vulnerability stems from improper bounds checking within the deleteOldestImages function, which processes database entries containing medical image metadata. When the system receives malformed or specially crafted queries through the DICOM query/retrieve service, it fails to properly validate the size of incoming data structures before performing memory operations. This allows attackers to overflow buffer boundaries and potentially overwrite adjacent memory regions, leading to arbitrary code execution or system instability. The heap-based nature of the overflow indicates that the vulnerable code allocates memory dynamically, making the attack surface more complex and potentially exploitable through memory corruption techniques.
Operationally, this vulnerability presents a significant risk to healthcare organizations relying on OFFIS DCMTK implementations for their medical imaging infrastructure. The remote attack vector means that malicious actors can exploit this weakness without physical access to the system, potentially compromising entire hospital networks that depend on DICOM services for radiology, cardiology, and other medical imaging workflows. The impact extends beyond simple service disruption, as successful exploitation could lead to data breaches containing sensitive patient medical information, system compromise, or denial of service attacks that could prevent critical medical procedures from accessing necessary imaging data. The vulnerability affects the core database handling functionality that manages medical image archives, making it a high-value target for attackers seeking to disrupt healthcare operations or extract sensitive data.
The recommended mitigation strategy involves applying the specific patch identified by the commit hash 0f78a4ef6f645ea5530166e445e5436a5de58e75, which contains the necessary code modifications to address the buffer overflow conditions. Organizations should prioritize immediate patch deployment across all systems running OFFIS DCMTK 3.7.0, particularly those handling sensitive medical data or serving as central repositories for DICOM images. Additional defensive measures include implementing network segmentation to limit access to DICOM services, deploying intrusion detection systems monitoring for anomalous query patterns, and establishing robust input validation procedures for all DICOM service endpoints. Security teams should also consider implementing application-level firewalls or API gateways to filter potentially malicious DICOM queries before they reach the vulnerable database handling components. This vulnerability aligns with CWE-121 heap-based buffer overflow categories and represents a potential attack vector classified under ATT&CK technique T1190 for exploitation of remote services, emphasizing the critical need for immediate remediation in healthcare environments where system reliability and data security are paramount.