CVE-2026-44034

Name of the Vulnerable Software and Affected Versions OFFIS DCMTK version 3.7.0

Description A heap-based out-of-bounds read exists in the decodeFrame() function within dcmdata/libsrc/dcrleccd.cc. This occurs when processing a crafted RLE Lossless DICOM file where the pixel data fragment is shorter than the 64-byte RLE header, allowing an attacker to read up to 63 bytes of adjacent heap memory or cause a crash. The issue stems from the function copying 64 bytes without verifying the fragment length. Applications that decode RLE images frame by frame, such as those using the getUncompressedFrame() function in DcmPixelData, are affected.

Recommendations Update OFFIS DCMTK version 3.7.0 by applying commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d. As a temporary mitigation, restrict the use of the decodeFrame() function or the getUncompressedFrame() method in DcmPixelData when processing untrusted DICOM files.