CVE-2026-44033: falha de média gravidade em OFFIS DCMTK
Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.8epss 0.1%
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
OFFIS · DCMTKCVEs relacionadas — OFFIS DCMTK
No mesmo produto, das mais perigosas para as menos.
CVE-2022-2119HIGHOFFIS DCMTK Path TraversalEPSS 3.4%CVE-2022-2120HIGHOFFIS DCMTK Path TraversalEPSS 3.4%CVE-2026-5663MEDIUMOFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injectionEPSS 2.0%CVE-2024-28130HIGHCVE-2024-28130EPSS 1.7%CVE-2022-2121HIGHOFFIS DCMTK NULL Pointer DereferenceEPSS 0.8%CVE-2024-52333HIGHCVE-2024-52333EPSS 0.6%