CVE-2026-44038 in DCMTK
Summary
by MITRE • 10/08/2026
A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a DICOM file with a crafted JPEG stream whose Huffman table defines a difference category above 15. Huffman symbol values are not range-checked unless DCMTK is built with DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK, which is disabled by default. dcmdjpeg and any application that decompresses JPEG DICOM images with DCMTK are affected. The issue is fixed in commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/08/2026
The vulnerability identified involves a global out-of-bounds read within the Huffman decoding logic of the Independent JPEG Group libraries bundled with OFFIS DCMTK versions 3.7.0 and earlier. This flaw specifically affects the libijg8, libijg12, and libijg16 components used for decompressing JPEG-encoded data in DICOM files. The root cause lies in the handling of Huffman tables where symbol values are not subjected to strict range checking by default. When a crafted JPEG stream is processed, specifically one containing a Huffman table that defines a difference category exceeding fifteen, the decoder attempts to access memory locations beyond the bounds of the extend_test and extend_offset lookup tables. These tables are critical for reconstructing bit lengths during the decoding process, and accessing them with invalid indices leads to reading arbitrary memory contents rather than triggering an immediate validation error.
From a technical perspective, this issue represents a classic out-of-bounds read vulnerability where input data is not properly validated against expected constraints before being used as array indices or offsets. The absence of strict Huffman table checks allows malformed inputs to bypass safety boundaries inherent in the decoding algorithm. In standard JPEG decompression workflows within DCMTK applications such as dcmdjpeg, this flaw can manifest in two primary ways depending on system state and memory layout: it may result in incorrectly decoded pixel data that corrupts medical imaging information, or it may cause a segmentation fault leading to application crashes. The severity of the impact is compounded by the fact that many DICOM viewers and processing tools rely heavily on automatic JPEG decompression without explicit user intervention for every file load, thereby increasing the attack surface significantly when interacting with untrusted sources.
The operational impact extends beyond simple denial of service through crashing applications. In scenarios where memory contents are leaked or used in subsequent computations due to incorrect decoding, there is a potential risk of information disclosure if sensitive data resides adjacent to the affected buffers in memory. Furthermore, corrupted pixel data can lead to diagnostic errors in clinical settings, potentially affecting patient care decisions based on inaccurate imaging results. This vulnerability aligns with CWE-125, which describes out-of-bounds read conditions that allow attackers to access unintended memory regions. Additionally, the exploitation vector relates to ATT&CK technique T1083, involving file and directory discovery or manipulation through crafted inputs designed to trigger specific software behaviors for malicious purposes.
Mitigation strategies primarily involve updating DCMTK to a version patched with commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5, which implements the necessary bounds checking logic. For organizations unable to immediately upgrade their software infrastructure, recompiling DCMTK with the DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK flag enabled provides a viable workaround by enforcing rigorous validation of Huffman table parameters before they are utilized in decoding operations. This configuration change ensures that any attempt to access invalid categories or symbol values triggers an error condition rather than proceeding with unsafe memory accesses. Security teams should also implement input sanitization at the network perimeter for DICOM services and ensure that all third-party libraries integrated into medical imaging pipelines are kept up-to-date to prevent exploitation of known decoder flaws in widely used standards like JPEG compression within DICOM environments.