CVE-2026-97059
DCMTK through 3.7.0 Heap Over-read via NumberOfFrames
OFFIS DCMTK
CVSS
8.8HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.
Text from CVE List
Affected versions 1
- DCMTKaffected: all versions through 3.7.0CVE List
References 7
- github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285Fixvia CVE List
- github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1Fixvia CVE List
- vulncheck.com/advisories/dcmtk-through-3.7.0-heap-over-read-via-numberofframesAdvisoryvia CVE List
- support.dcmtk.org/redmine/issues/1281Referencevia CVE List
- github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L334-L360Referencevia CVE List
- github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L399-L430Referencevia CVE List
- github.com/DCMTK/dcmtkReferencevia CVE List