CVE-2026-97059: high-severity vulnerability in OFFIS DCMTK
DCMTK through 3.7.0 Heap Over-read via NumberOfFrames
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.3%
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
Affected products
OFFIS · DCMTKRelated CVEs — OFFIS DCMTK
In the same product, most dangerous first.
CVE-2022-2119HIGHOFFIS DCMTK Path TraversalEPSS 3.4%CVE-2022-2120HIGHOFFIS DCMTK Path TraversalEPSS 3.4%CVE-2026-5663MEDIUMOFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injectionEPSS 2.0%CVE-2024-28130HIGHCVE-2024-28130EPSS 1.7%CVE-2022-2121HIGHOFFIS DCMTK NULL Pointer DereferenceEPSS 0.8%CVE-2024-52333HIGHCVE-2024-52333EPSS 0.6%
References
https://github.com/DCMTK/dcmtkhttps://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L334-L360https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L399-L430https://github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285https://github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1https://support.dcmtk.org/redmine/issues/1281https://www.vulncheck.com/advisories/dcmtk-through-3.7.0-heap-over-read-via-numberofframes