CVE-2026-44031 in DCMTK
Summary
by MITRE • 10/08/2026
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified in the OFFIS DCMTK library version 3.7.0 represents a critical security flaw rooted in uncontrolled recursion within the dcmdata module. Specifically, the functions DcmSequenceOfItems::read() and DcmItem::read() fail to implement adequate safeguards against deeply nested data structures. This architectural deficiency allows an attacker to craft malicious DICOM datasets containing sequences of items with excessive nesting levels. When these malformed files are processed by DCMTK-based applications, the recursive parsing logic consumes stack memory at a rate that quickly exceeds available resources, leading to stack exhaustion and subsequent process crashes. The impact is severe as it results in a denial of service condition for any DICOM service or local tool relying on this library, including storescp, dcmrecv, dcmqrscp, and diagnostic utilities like dcmdump.
The operational risk is amplified by the fact that many DICOM services parse incoming datasets before performing authentication checks. This design choice means that a remote, unauthenticated attacker can trigger the vulnerability simply by sending a specially crafted C-STORE request to any DCMTK-based server listening on standard DICOM ports. The attack does not require valid credentials or prior interaction with the system beyond network connectivity. Local tools are also vulnerable because they process files opened by users without validating structural complexity beforehand, meaning that even local file operations can be weaponized if a user opens a maliciously constructed DICOM file. This broad surface area affects both server-side infrastructure and client-side diagnostic applications alike.
From a classification perspective, this vulnerability aligns with CWE-675, which describes the use of potentially dangerous algorithms or uncontrolled recursion leading to resource exhaustion. It also relates to CWE-400 regarding unconstrained resource consumption. In terms of offensive security frameworks, this flaw can be leveraged within MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under subtechniques involving application crash via malformed input. The lack of depth limits in recursive parsing functions is a common pattern in legacy codebases that were not designed with adversarial inputs in mind, highlighting the need for stricter input validation and structural constraints in medical imaging software libraries.
The resolution to this issue was implemented through commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which introduces a configurable limit on sequence nesting depth. By default, the library now restricts recursion to sixty-four levels deep, effectively preventing stack exhaustion while maintaining compatibility with standard DICOM datasets that rarely exceed such depths in legitimate use cases. Organizations utilizing DCMTK must update their libraries to this patched version or later to mitigate the risk. Additionally, administrators should ensure that deployment pipelines incorporate updated dependencies and verify that no custom forks of the library have reverted these safety checks. Monitoring for abnormal memory usage patterns in DICOM services can also serve as a secondary detection mechanism during the transition period before full patching is achieved.