CVE-2026-44038

Name of the Vulnerable Software and Affected Versions OFFIS DCMTK version 3.7.0

Description A global out-of-bounds read exists in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12, and libijg16). This occurs when processing a DICOM file containing a crafted JPEG stream where the Huffman table defines a difference category greater than 15. Because Huffman symbol values are not range-checked by default, an attacker can read memory beyond the extend test[] and extend offset[] tables, leading to a crash or incorrectly decoded pixel data. This affects dcmdjpeg and any application using DCMTK to decompress JPEG DICOM images.

Recommendations Update OFFIS DCMTK version 3.7.0 by applying the fix in commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5. Build DCMTK with the DCMTK ENABLE STRICT HUFFMAN TABLE CHECK flag enabled to ensure Huffman symbol values are range-checked.