OFFIS DCMTK CVE-2026-44035

Exploitation requires the victim to open a crafted DICOMDIR file in an application built on DCMTK 3.7.0 (e.g., dcmgpdir or any DCMTK-based media viewer); the malicious file must contain directory records recursively chained through the 'Offset of Referenced Lower-Level Directory Entity' attribute to a depth sufficient to exhaust the stack. No authentication is required (PR:N), but exploitation is bounded by the need for passive user interaction (UI:P) - a user or automated process must actually load the file - and by the local attack vector (AV:L), meaning the attacker must get the crafted file onto the target system or into its import workflow. Impact is limited to a process crash (availability only); there is no code execution, data disclosure, or integrity impact. Affected scope is narrowed to deployments running the vulnerable 3.7.0 release that have not applied commit ca761f7f.

This is a medium-severity, availability-only denial-of-service issue, and the aggregated signals are consistent rather than conflicting. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) correctly frames it as local, low-complexity, requiring passive user interaction (opening a file), with impact confined entirely to availability (VA:H) and zero confidentiality or integrity impact - matching CWE-674 (uncontrolled recursion → stack exhaustion → crash). Exploitation status is 'no public exploit identified at time of analysis': the input contains no KEV listing and no POC flag, and no EPSS score was provided, so exploitation probability cannot be quantified from the data given. The absence of code-execution or data-exposure potential means that even though triggering the bug is trivial, the worst realistic outcome is a crash of the viewing process. This is therefore a genuine but non-urgent patch-management item rather than a critical priority: it matters most for automated or batch DICOMDIR-processing pipelines where repeated crashes could disrupt service, and far less for interactive single-user viewers. No key signals contradict each other; the main gap is the lack of EPSS/KEV data to gauge real-world exploitation interest.

An attacker crafts a malicious DICOMDIR file containing a deeply chained sequence of directory records linked through the 'Offset of Referenced Lower-Level Directory Entity' attribute, then delivers it to a victim (e.g., on removable media, as an email attachment, or via a PACS/import workflow). When the victim opens it with dcmgpdir or any DCMTK-based media viewer, moveRecordToTree() recurses once per level until the stack is exhausted and the process crashes. No public exploit code is identified in the provided data, and the local attack vector plus required user interaction (UI:P) means the attacker must get the target to open the file.