CVE-2026-97059

Name of the Vulnerable Software and Affected Versions DCMTK versions prior to 3.7.1

Description A heap over-read occurs in the ConcatenationLoader when copying pixel data frames. The issue arises because the software fails to validate the PixelData buffer length against the declared NumberOfFrames. An attacker can use a specially crafted DICOM instance that declares more frames than the buffer actually contains, leading to an application crash or the leakage of adjacent heap memory.

Recommendations Update to a version newer than 3.7.0.