PT-2026-107945
CVE-2026-44036
·
تاريخ النشر
2026-10-08
·
تاريخ التحديث
2026-10-15
الوصف من
CVSS 4.0
6.8
متوسطةالمقاييسAV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OFFIS DCMTK version 3.7.0
Description
Uncontrolled mutual recursion between the
parseDataSet() and parseSequence() functions in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) can lead to a denial of service. An attacker can trigger stack exhaustion and a process crash by providing a crafted XML file containing deeply nested sequence and item elements. This affects the xml2dcm tool and any service utilizing this code to convert untrusted XML to DICOM.Recommendations
Apply the fix provided in commit 87f256d73e30656a822bf7d76d1cf1d9bb693954 for version 3.7.0.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾