Skip to main content

DCMTK CVE-2026-35505

| EUVDEUVD-2026-40420 HIGH
Memory Leak (CWE-401)
2026-06-30 icscert GHSA-p8qm-mxfj-7vc2
Information Disclosure Dcmtk Toolkit
8.7
CVSS 4.0 · Vendor: icscert
Share

Severity by source

Vendor (icscert) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

Unauthenticated network-triggered memory leak with low complexity (PR:N/AV:N/AC:L), impact limited to availability via service crash (A:H; C:N/I:N), no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
Analysis Generated
Jun 30, 2026 - 22:02 vuln.today

DescriptionCVE.org

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.

AnalysisAI

Denial of service in OFFIS DCMTK DICOM toolkit allows an unauthenticated remote attacker to exhaust memory by repeatedly sending crafted connection requests, each of which leaks unfreed memory. In single-process deployments the leaked memory accumulates until the service process is killed by the OS and the listening port stops responding until a manual restart. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach exposed DCMTK DICOM port
Delivery
Send crafted connection/association request
Exploit
Leak unfreed memory per request
Execution
Repeat to exhaust process memory
Impact
Service killed, port stops responding
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires only network reachability to a DICOM service built on DCMTK that accepts inbound connection/association requests; no authentication, no user interaction, and no special feature toggle are needed (AV:N/AC:L/PR:N/UI:N) - the leak is triggered by the normal connection-request handling path. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms a network-reachable, low-complexity, unauthenticated attack requiring no user interaction, with impact confined to availability (VA:H; VC:N/VI:N - no confidentiality or integrity loss). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach the DICOM network port (e.g., an exposed or insufficiently segmented modality/PACS listener built on DCMTK) scripts repeated crafted connection/association requests against the service. With no authentication or user interaction required, each request leaks memory; over time the single-process service exhausts available memory, is killed by the OS, and the imaging port stops accepting connections until an operator manually restarts it. …
Remediation Upgrade DCMTK to the current fixed release referenced in the advisory (https://github.com/DCMTK/dcmtk/releases/tag/latest); the input does not specify an exact tagged fix version, so the released patched version is not independently confirmed and operators should confirm the precise build that contains the CWE-401 fix against ICSMA-26-181-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

24 hours: Identify and inventory all DCMTK deployments; restrict network access to the DCMTK service to authorized clinical networks and systems only. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Dcmtk Toolkit

View all
CVE-2026-50003 CRITICAL
9.3 Jun 30

Path traversal in OFFIS DCMTK (DICOM Toolkit) lets a malicious or compromised DICOM server write attacker-controlled fil
CVE-2026-52868 HIGH
8.8 Jun 30

Path traversal in OFFIS DCMTK DICOM toolkit lets an unauthenticated network attacker read DICOM Modality Worklist record
CVE-2026-44628 HIGH
8.7 Jun 30

Denial of service in OFFIS DCMTK's DICOM worklist server (wlmscpfs) allows a remote, unauthenticated attacker to crash t
CVE-2026-50254 HIGH
8.7 Jun 30

Denial of service in OFFIS DCMTK's storescp DICOM receiver allows an unauthenticated remote attacker to exhaust process

Same weakness CWE-401 – Memory Leak

View all
CVE-2025-56353 HIGH POC
7.5
CVE-2026-50254 HIGH
8.7
CVE-2026-3650 HIGH
8.7
CVE-2025-26311 MEDIUM POC
6.5
CVE-2025-25469 MEDIUM POC
6.5
CVE-2025-26308 MEDIUM POC
6.5
CVE-2025-26307 MEDIUM POC
6.5
CVE-2025-26306 MEDIUM POC
6.5

Same technique Information Disclosure

View all
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2014-6324 HIGH POC
8.8
CVE-2017-0213 HIGH POC
7.3
CVE-2016-7255 HIGH POC
7.8
CVE-2010-0232 HIGH POC
7.8
CVE-2025-30066 HIGH POC
8.6
CVE-2025-54236 CRITICAL POC
9.1

Share

CVE-2026-35505 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy