GCVE-1988-2026-0023

Vulnerability from gna-1988 – Published: 2026-09-07 13:20 – Updated: 2026-09-09 10:11
VLAI
Title
[SYSS-2026-046]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)
Summary
Advisory ID: SYSS-2026-046 Product: DCMTK (DICOM ToolKit) Manufacturer: OFFIS e.V. / DCMTK Community Affected Version(s): 3.7.0 Tested Version(s): 3.7.0 Vulnerability Type: Integer Overflow or Wraparound (CWE-190) Risk Level: High Solution Status: Fixed Manufacturer Notification: 2026-07-02 Solution Date: 2026-07-03 Public Disclosure: 2026-07-31 CVE Reference: Not yet assigned Author of Advisory: Matthias Deeg, SySS GmbH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: DCMTK (DICOM ToolKit) is an open-source collection of libraries and applications implementing large parts of the DICOM (Digital Imaging and Communications in Medicine) standard (see [1]). DCMTK's DICOMDIR icon image loading is vulnerable to an integer overflow in the PGM image size calculation. An attacker who can supply a malicious PGM file referenced as an external icon can cause a heap out-of-bounds read in the icon scaler, leading to a process crash or potential information disclosure. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The function DicomDirInterface::getIconFromFile() in libsrc/dcddirif.cc (line 4489) computes the PGM image buffer size by multiplying the width and height parsed from the PGM file header: unsigned int pgmWidth, pgmHeight = 0; // ... values parsed from PGM file via sscanf() const unsigned long pgmSize = pgmWidth * pgmHeight; Uint8 *pgmData = new Uint8[pgmSize]; Both pgmWidth and pgmHeight are unsigned int. Their product is computed as unsigned int, and only then assigned to unsigned long. On any platform where unsigned int is 32 bits, a crafted PGM file with the dimensions 4294967295 * 4294967295 produces pgmSize = 1 after overflow (4294967295 * 4294967295 = 0x100000001, truncated to 32 bits = 1). The allocation "new Uint8[1]" succeeds, and fread() reads exactly 1 byte from the PGM file. The icon scaler is invoked at line 4505 of dcddirif.cc: result = ImagePlugin->scaleData(pgmData, pgmWidth, pgmHeight, pixel, width, height); The scaler implementation (DicomDirImageImplementation::scaleData in dcmjpeg/libsrc/ddpiimpl.cc, line 60) casts the dimensions from unsigned int to Uint16 without validation: DiScaleTemplate<Uint8> scale(1, OFstatic_cast(Uint16, srcWidth), // 4294967295 -> 65535 OFstatic_cast(Uint16, srcHeight), // 4294967295 -> 65535 OFstatic_cast(Uint16, dstWidth), OFstatic_cast(Uint16, dstHeight), 1); scale.scaleData(OFstatic_cast(const Uint8 **, &srcData), &dstData, 1 /* interpolate */); The DiScaleTemplate constructor (dcmimgle/include/dcmtk/dcmimgle/discalet.h, line 148) stores the truncated dimensions: DiScaleTemplate(const int planes, const Uint16 src_cols, // resolution of source image const Uint16 src_rows, const Uint16 dest_cols, const Uint16 dest_rows, const Uint32 frames, const int bits = 0) The scaleData() method (line 187) then iterates over the source image using the truncated dimensions (65535 * 65535), reading from the 1-byte heap allocation through the interpolatePixel() method, causing a heap out-of-bounds read. The root cause is the unchecked cast from unsigned int to Uint16 in the scaler (ddpiimpl.cc:60), which silently truncates dimensions without any bounds validation. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): The integer overflow can be demonstrated using a specially crafted PGM file. The following shell script exemplarily creates such a file named demo.pgm: cat > create_pgm.sh << 'EOF' #!/bin/bash printf 'P5\n4294967295 4294967295\n255\n' > demo.pgm printf '\x00' >> demo.pgm EOF If this PGM file is processed by a vulnerable DCMTK component like dcmmkdir, a heap out-of-bounds read is triggered, causing a segmentation fault in this proof-of-concept example. The DICOM file PAT001 does not contain pixel data and thus forces a fallback to the default icon. dcmmkdir +X --default-icon demo.pgm PAT001 E: no pixel data found in DICOM dataset W: cannot create monochrome icon from image file, using default ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: This security issue was fixed with the commit 534e146b672ccd13d1a2b134ef623840e775396a (see [4]). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2026-07-02: Vulnerability reported to manufacturer 2026-07-02: Manufacturer acknowledges receipt of security advisories 2026-07-03: Security fix published by manufacturer (see [4]) 2026-07-31: Public release of security advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] DCMTK project website https://dcmtk.org/en/ [2] SySS Security Advisory SYSS-2026-046 [3] SySS GmbH, SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy [4] DCMTK security fix ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: This security vulnerability was found by Matthias Deeg of SySS GmbH with the assistance of SySS AI. E-Mail: matthias.deeg (at) syss.de Key fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS website. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 4.0 URL: https://creativecommons.org/licenses/by/4.0/deed.en _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
CWE
Assigner
VULNARCHIVE GNA GNA-1988
GNA scorecard E 38/100 over 556 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Dicom DICOM Toolkit Affected: unknown
guessed Create a notification for this product.
Credits
Matthias Deeg via Fulldisclosure
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "DICOM Toolkit",
          "vendor": "Dicom",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Matthias Deeg via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Advisory ID:               SYSS-2026-046\nProduct:                   DCMTK (DICOM ToolKit)\nManufacturer:              OFFIS e.V. / DCMTK Community\nAffected Version(s):       3.7.0\nTested Version(s):         3.7.0\nVulnerability Type:        Integer Overflow or Wraparound (CWE-190)\nRisk Level:                High\nSolution Status:           Fixed\nManufacturer Notification: 2026-07-02\nSolution Date:             2026-07-03\nPublic Disclosure:         2026-07-31\nCVE Reference:             Not yet assigned\nAuthor of Advisory:        Matthias Deeg, SySS GmbH\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nOverview:\n\nDCMTK (DICOM ToolKit) is an open-source collection of libraries and\napplications implementing large parts of the DICOM (Digital Imaging\nand Communications in Medicine) standard (see [1]).\n\nDCMTK\u0027s DICOMDIR icon image loading is vulnerable to an integer overflow\nin the PGM image size calculation. An attacker who can supply a\nmalicious PGM file referenced as an external icon can cause a heap\nout-of-bounds read in the icon scaler, leading to a process crash or\npotential information disclosure.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nVulnerability Details:\n\nThe function DicomDirInterface::getIconFromFile() in libsrc/dcddirif.cc\n(line 4489) computes the PGM image buffer size by multiplying the width\nand height parsed from the PGM file header:\n\n  unsigned int pgmWidth, pgmHeight = 0;\n  // ... values parsed from PGM file via sscanf()\n  const unsigned long pgmSize = pgmWidth * pgmHeight;\n  Uint8 *pgmData = new Uint8[pgmSize];\n\nBoth pgmWidth and pgmHeight are unsigned int. Their product is computed\nas unsigned int, and only then assigned to unsigned long.\n\nOn any platform where unsigned int is 32 bits, a crafted PGM file with the\ndimensions 4294967295 * 4294967295 produces pgmSize = 1 after overflow\n(4294967295 * 4294967295 = 0x100000001, truncated to 32 bits = 1).\n\nThe allocation \"new Uint8[1]\" succeeds, and fread() reads exactly 1 byte\nfrom the PGM file.\n\nThe icon scaler is invoked at line 4505 of dcddirif.cc:\n\n  result = ImagePlugin-\u003escaleData(pgmData, pgmWidth, pgmHeight,\n                                  pixel, width, height);\n\nThe scaler implementation (DicomDirImageImplementation::scaleData in\ndcmjpeg/libsrc/ddpiimpl.cc, line 60) casts the dimensions from\nunsigned int to Uint16 without validation:\n\n  DiScaleTemplate\u003cUint8\u003e scale(1,\n      OFstatic_cast(Uint16, srcWidth),   // 4294967295 -\u003e 65535\n      OFstatic_cast(Uint16, srcHeight),  // 4294967295 -\u003e 65535\n      OFstatic_cast(Uint16, dstWidth),\n      OFstatic_cast(Uint16, dstHeight),\n      1);\n  scale.scaleData(OFstatic_cast(const Uint8 **, \u0026srcData),\n                  \u0026dstData, 1 /* interpolate */);\n\nThe DiScaleTemplate constructor (dcmimgle/include/dcmtk/dcmimgle/discalet.h,\nline 148) stores the truncated dimensions:\n\n  DiScaleTemplate(const int planes,\n                  const Uint16 src_cols,   // resolution of source image\n                  const Uint16 src_rows,\n                  const Uint16 dest_cols,\n                  const Uint16 dest_rows,\n                  const Uint32 frames,\n                  const int bits = 0)\n\nThe scaleData() method (line 187) then iterates over the source image\nusing the truncated dimensions (65535 * 65535), reading from the 1-byte\nheap allocation through the interpolatePixel() method, causing a heap\nout-of-bounds read.\n\nThe root cause is the unchecked cast from unsigned int to Uint16 in the\nscaler (ddpiimpl.cc:60), which silently truncates dimensions without any\nbounds validation.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nProof of Concept (PoC):\n\nThe integer overflow can be demonstrated using a specially crafted PGM\nfile. The following shell script exemplarily creates such a file named\ndemo.pgm:\n\ncat \u003e create_pgm.sh \u003c\u003c \u0027EOF\u0027\n#!/bin/bash\nprintf \u0027P5\\n4294967295 4294967295\\n255\\n\u0027 \u003e demo.pgm\nprintf \u0027\\x00\u0027 \u003e\u003e demo.pgm\nEOF\n\nIf this PGM file is processed by a vulnerable DCMTK component like\ndcmmkdir, a heap out-of-bounds read is triggered, causing a segmentation\nfault in this proof-of-concept example. The DICOM file PAT001 does not\ncontain pixel data and thus forces a fallback to the default icon.\n\ndcmmkdir +X --default-icon demo.pgm PAT001\nE: no pixel data found in DICOM dataset\nW: cannot create monochrome icon from image file, using default\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSolution:\n\nThis security issue was fixed with the commit\n534e146b672ccd13d1a2b134ef623840e775396a (see [4]).\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclosure Timeline:\n\n2026-07-02: Vulnerability reported to manufacturer\n2026-07-02: Manufacturer acknowledges receipt of security advisories\n2026-07-03: Security fix published by manufacturer (see [4])\n2026-07-31: Public release of security advisory\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nReferences:\n\n[1] DCMTK project website\n    https://dcmtk.org/en/\n[2] SySS Security Advisory SYSS-2026-046\n\n[3] SySS GmbH, SySS Responsible Disclosure Policy\n    https://www.syss.de/en/responsible-disclosure-policy\n[4] DCMTK security fix\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCredits:\n\nThis security vulnerability was found by Matthias Deeg of SySS GmbH with\nthe assistance of SySS AI.\n\nE-Mail: matthias.deeg (at) syss.de\n\nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nDisclaimer:\n\nThe information provided in this security advisory is provided \"as is\"\nand without warranty of any kind. Details of this security advisory may\nbe updated in order to provide as accurate information as possible. The\nlatest version of this security advisory is available on the SySS\nwebsite.\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nCopyright:\n\nCreative Commons - Attribution (by) - Version 4.0\nURL: https://creativecommons.org/licenses/by/4.0/deed.en\n\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "CWE-190",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T10:11:57Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/24"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Aug/24"
        },
        {
          "url": "https://creativecommons.org/licenses/by/4.0/deed.en"
        },
        {
          "url": "https://dcmtk.org/en/"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.syss.de/en/responsible-disclosure-policy"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Aug/24"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "[SYSS-2026-046]: DICOM Toolkit (DCMTK) - Integer Overflow or Wraparound (CWE-190)",
      "x_gcve": [
        {
          "recordType": "advisory",
          "relationships": [],
          "vulnId": "GCVE-1988-2026-0023",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Aug/24",
            "automated": true,
            "contentSha256": "3fe43991bbc456a96307ac83f61414a6bd51af98439dd5d1de4bdfbd1709ab9c",
            "evidenceScore": 8,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Aug/24",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-07-31T07:57:54Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-07T13:20:20Z",
    "dateUpdated": "2026-09-09T10:11:57Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0023"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.