{"id":"CVE-2026-44031","published":"2026-10-08T13:17:17.027","lastModified":"2026-10-08T21:10:00.133","description":"Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwes":["CWE-674"],"vendors":[],"products":[],"references":[{"url":"https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","tags":[]},{"url":"https://support.dcmtk.org/redmine/issues/1191","tags":[]}],"exploitRefs":[{"url":"https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f","tags":[]}],"hasPoc":true,"ai":{"summary":"A remote attacker can trigger stack exhaustion and process crashes in OFFIS DCMTK 3.7.0 by sending a DICOM dataset with deeply nested sequences, causing denial of service without authentication. This affects DICOM services like storescp, dcmrecv, and dcmqrscp, as well as local tools like dcmdump.","exploitability":"Exploitation is straightforward with no authentication required, needing only a specially crafted DICOM dataset with deeply nested sequences to be sent to any affected DICOM service or tool.","blast_radius":"The impact is significant across healthcare systems using DCMTK-based DICOM services, potentially causing widespread denial of service in medical imaging workflows and data handling processes.","remediation":"Upgrade to OFFIS DCMTK version 3.7.1 or later, which includes the fix for uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read().","detection":"No reliable host or network indicator is derivable from the published description.","tags":["dos","medical-imaging","dicom","stack-exhaustion"],"model":"garnet-coder","analyzedAt":"2026-10-16T09:26:59.335Z"}}