CVE-2026-44034: medium-severity vulnerability in OFFIS DCMTK
Heap out-of-bounds read in DCMTK RLE decodeFrame()
Published
10Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.8
exploitation probability
—
observed exploitation
nono source reports it
A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RLE header. The function copies 64 bytes without checking the fragment length, a check that the sibling function decode() already performs. Applications that decode RLE images frame by frame (for example, through DcmPixelData::getUncompressedFrame()) are affected. The dcmdrle command-line tool uses decode() and is not affected. The issue is fixed in commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
OFFIS · DCMTKRelated CVEs — OFFIS DCMTK
In the same product, most dangerous first.
CVE-2022-2119HIGHOFFIS DCMTK Path TraversalEPSS 3.3%CVE-2022-2120HIGHOFFIS DCMTK Path TraversalEPSS 3.3%CVE-2026-5663MEDIUMOFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injectionEPSS 2.8%CVE-2024-28130HIGHCVE-2024-28130EPSS 1.7%CVE-2022-2121HIGHOFFIS DCMTK NULL Pointer DereferenceEPSS 0.8%CVE-2024-52333HIGHCVE-2024-52333EPSS 0.6%