Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service
Summary
| CVE | CVE-2026-44035 |
|---|---|
| State | PUBLISHED |
| Assigner | securin |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-08 13:17:17 UTC |
| Updated | 2026-10-08 21:10:00 UTC |
| Description | Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f. |
Risk And Classification
Primary CVSS: v4.0 6.8 MEDIUM from 33c584b5-0579-4c06-b2a0-8d8329fcab9c
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.001050000 probability, percentile 0.010120000 (date 2026-10-10)
Problem Types: CWE-674 | CWE-674 CWE-674 Uncontrolled Recursion
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 33c584b5-0579-4c06-b2a0-8d8329fcab9c | Secondary | 6.8 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.8 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| 3.1 | 33c584b5-0579-4c06-b2a0-8d8329fcab9c | Secondary | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
| 3.1 | CNA | CVSS | 5.5 | MEDIUM | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H |
CVSS v4.0 Breakdown
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/DCMTK/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f | 33c584b5-0579-4c06-b2a0-8d8329fcab9c | github.com | |
| support.dcmtk.org/redmine/issues/1215 | 33c584b5-0579-4c06-b2a0-8d8329fcab9c | support.dcmtk.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Arjun Basnet from Securin (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-05-25T00:00:00.000Z | CVE ID shared with the vendor |
| CNA | 2026-05-25T00:00:00.000Z | Fix committed by the vendor |
| CNA | 2026-06-19T00:00:00.000Z | Vendor approved publication |
Solutions
CNA: Update to a DCMTK version that contains commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f. As of the publication date, no tagged release after DCMTK 3.7.0 includes this fix, so apply the commit or build from the current master branch.