EUVD-2026-40420
GHSA-p8qm-mxfj-7vc2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network-triggered memory leak with low complexity (PR:N/AV:N/AC:L), impact limited to availability via service crash (A:H; C:N/I:N), no scope change.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.
AnalysisAI
Denial of service in OFFIS DCMTK DICOM toolkit allows an unauthenticated remote attacker to exhaust memory by repeatedly sending crafted connection requests, each of which leaks unfreed memory. In single-process deployments the leaked memory accumulates until the service process is killed by the OS and the listening port stops responding until a manual restart. No public exploit identified at time of analysis; CVSS 4.0 base score is 8.7 (availability-only impact), reported through CISA ICS-CERT medical advisory ICSMA-26-181-01.
Technical ContextAI
DCMTK (DICOM Toolkit) by OFFIS is an open-source C/C++ implementation of the DICOM standard used to build medical imaging applications, PACS components, and DICOM network services (C-STORE/C-FIND/C-MOVE SCPs and SCUs). The flaw is classified as CWE-401 (Missing Release of Memory after Effective Lifetime) - a memory leak in the code path that processes inbound DICOM association/connection requests, where allocated buffers or association structures are not freed when connections are received and torn down. Because each crafted request leaks memory without ever releasing it, an attacker can drive cumulative consumption upward without bound. The affected component is identified by CPE cpe:2.3:a:offis_dicom:dcmtk_toolkit, i.e. the DCMTK toolkit itself rather than a single downstream product.
RemediationAI
Upgrade DCMTK to the current fixed release referenced in the advisory (https://github.com/DCMTK/dcmtk/releases/tag/latest); the input does not specify an exact tagged fix version, so the released patched version is not independently confirmed and operators should confirm the precise build that contains the CWE-401 fix against ICSMA-26-181-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01). As compensating controls until patching, restrict network reachability of the DICOM listener by firewalling the DICOM port (commonly TCP 104/11112) to known, trusted imaging peers only, since the attack requires network access to the service - the trade-off is that any legitimate ad-hoc DICOM peers must be explicitly allowlisted. For single-process deployments, run the listener under a process supervisor that monitors memory and auto-restarts on OOM, and/or front it with a proxy that rate-limits and caps concurrent connections from a single source to slow leak accumulation - trade-offs are brief service interruptions on restart and possible throttling of high-volume legitimate clients. Avoid single-process deployment where feasible, since the description ties the fatal crash specifically to that mode.
More in Dcmtk Toolkit
View allPath traversal in OFFIS DCMTK (DICOM Toolkit) lets a malicious or compromised DICOM server write attacker-controlled fil
Path traversal in OFFIS DCMTK DICOM toolkit lets an unauthenticated network attacker read DICOM Modality Worklist record
Denial of service in OFFIS DCMTK's DICOM worklist server (wlmscpfs) allows a remote, unauthenticated attacker to crash t
Denial of service in OFFIS DCMTK's storescp DICOM receiver allows an unauthenticated remote attacker to exhaust process
Same weakness CWE-401 – Memory Leak
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today