CVE-2026-44031

Name of the Vulnerable Software and Affected Versions OFFIS DCMTK version 3.7.0

Description Uncontrolled recursion in the DcmSequenceOfItems::read() and DcmItem::read() functions within the dcmdata library allows a remote, unauthenticated attacker to cause a denial of service resulting in stack exhaustion and process crash. This occurs when the software processes a DICOM dataset containing deeply nested sequences (SQ elements). The issue affects services that parse datasets before authentication, such as those using C-STORE requests in storescp, dcmrecv, and dcmqrscp, as well as local tools like dcmdump when opening a malicious file.

Recommendations Update OFFIS DCMTK version 3.7.0 by applying commit 885ff0f10372bd589b5f44cea974f28a3964cb0f to implement a configurable sequence nesting depth limit.