PT-2026-107942
CVE-2026-44033
·
Published
2026-10-08
·
Updated
2026-10-08
Description by
CVSS 4.0
6.8
MediumMetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OFFIS DCMTK version 3.7.0
Description
Uncontrolled recursion in the bundled XML parser (ofstd/libsrc/ofxml.cc) can lead to a denial of service resulting in stack exhaustion and process crash. This occurs when the parser processes a crafted XML document containing deeply nested elements. The issue is accessible via the
dcmencap tool during CDA document encapsulation, or through any application utilizing the parseFile() or parseString() functions of OFXMLParser on untrusted input. The specific vulnerable functions are ParseXMLElement() and emptyTheNode() within XMLNode.Recommendations
Apply the fix provided in commit d12e350e687530eb41e2b0c860aff4d8c04e5941 for version 3.7.0.
As a temporary mitigation, avoid using the
parseFile() and parseString() functions of OFXMLParser on untrusted input. Found an issue in the description? Have something to add? Feel free to write us 👾