CVE-2026-44035 in DCMTK
Summary
by MITRE • 10/08/2026
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified as Uncontrolled Recursion in the OFFIS DCMTK library, specifically within the DcmDicomDir::moveRecordToTree() function located in dcmdata/libsrc/dcdicdir.cc of version 3.7.0, represents a critical security flaw that enables denial-of-service attacks through stack exhaustion. This issue arises from the way the software processes DICOMDIR files, which are specialized metadata containers used to organize and reference medical imaging data stored on physical media such as CDs or DVDs. The core technical defect lies in the recursive algorithm employed by moveRecordToTree() when parsing directory records that contain sequences linked via the Offset of Referenced Lower-Level Directory Entity attribute. When an attacker crafts a DICOMDIR file with a deeply chained sequence of these references, effectively creating a circular reference or an excessively deep tree structure, the function enters infinite recursion without adequate depth limiting mechanisms. Each recursive call consumes stack space for local variables and return addresses, leading to rapid exhaustion of the available stack memory allocated to the process.
The operational impact of this vulnerability is severe for any application that utilizes DCMTK libraries to open or parse DICOMDIR files. This includes standalone tools like dcmgpdir as well as broader media viewers and PACS (Picture Archiving and Communication System) components built upon the DCMTK framework. Upon encountering a maliciously crafted file, these applications will experience a stack overflow condition, resulting in an immediate process crash or termination. While this vulnerability does not currently allow for arbitrary code execution due to modern operating system protections against direct stack exploitation via simple overflows, it effectively disrupts service availability by crashing the application handling the input data. This denial-of-service capability can be exploited remotely if a victim is tricked into opening a malicious DICOMDIR file through email attachments or compromised web portals that automatically parse such files for preview purposes.
From a classification perspective, this vulnerability aligns with CWE-675, which describes operations on multiple resources without detecting or limiting the number of iterations, specifically manifesting here as uncontrolled recursion leading to resource exhaustion. It also relates closely to CWE-400, concerning Uncontrolled Resource Consumption, where the system fails to limit the amount of computational resources consumed by a single input vector. In terms of adversary tactics and techniques, this exploit maps to MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion via application crashes or infinite loops. The lack of validation on the depth of directory record chains allows an attacker to bypass normal operational boundaries and force the system into a failure state without requiring authentication or elevated privileges beyond opening the file.
Mitigation strategies for this vulnerability primarily involve upgrading to patched versions of DCMTK where the issue has been resolved, as indicated by commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f which introduces safeguards against excessive recursion depth. For organizations unable to immediately patch their systems, defensive measures should include implementing strict input validation and sanitization routines for DICOMDIR files before they are processed by DCMTK components. This can be achieved through the use of wrapper libraries or middleware that pre-scan directory structures for circular references or excessive nesting levels prior to invoking the vulnerable moveRecordToTree() function. Additionally, deploying network-level intrusion detection systems capable of identifying anomalous file sizes or patterns in DICOM traffic may help block malicious payloads before they reach susceptible endpoints. Security teams should also consider increasing stack size limits where feasible and enabling core dump analysis tools to better detect such crashes during incident response activities.