PT-2026-107945
CVE-2026-44036
·
Published
2026-10-08
·
Updated
2026-10-15
Description by
CVSS 4.0
6.8
MediumMetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OFFIS DCMTK version 3.7.0
Description
Uncontrolled mutual recursion between the
parseDataSet() and parseSequence() functions in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) can lead to a denial of service. An attacker can trigger stack exhaustion and a process crash by providing a crafted XML file containing deeply nested sequence and item elements. This affects the xml2dcm tool and any service utilizing this code to convert untrusted XML to DICOM.Recommendations
Apply the fix provided in commit 87f256d73e30656a822bf7d76d1cf1d9bb693954 for version 3.7.0.
Found an issue in the description? Have something to add? Feel free to write us 👾