PT-2026-107946
CVE-2026-44037
·
Published
2026-10-08
·
Updated
2026-10-08
Description by
CVSS 4.0
6.8
MediumMetricsAV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
OFFIS DCMTK version 3.7.0
Description
Uncontrolled mutual recursion occurs between the functions
parseDataSet(), parseElement(), and parseSequence() within the DcmJSONReader class. An attacker can trigger a denial of service, resulting in stack exhaustion and a process crash, by providing a specially crafted DICOM JSON document containing deeply nested sequence (SQ) values. This issue affects the json2dcm tool and any service that utilizes this reader to convert untrusted DICOM JSON, such as DICOMweb payloads.Recommendations
Apply the fix provided in commit cf955e64c35a1e07ba10698f639d5dcdec53b9d7 for version 3.7.0.
Found an issue in the description? Have something to add? Feel free to write us 👾