OFFIS DCMTK CVE-2026-44036

Exploitation requires that the vulnerable DCMTK 3.7.0 XML-to-DICOM conversion code (xml2dcm.cc, via the xml2dcm tool or any embedding application) be invoked on attacker-controlled XML input. The specific trigger is an XML document with sequence (<sequence>) and item elements nested more deeply than the call stack can sustain, driving the unbounded mutual recursion between parseDataSet() and parseSequence(). LIMITING FACTORS: the official vector is LOCAL (AV:L) with passive user interaction (UI:P), meaning a user or service must be induced to process the malicious file - it is not self-propagating; impact is confined to a process crash (availability) with no code execution, data disclosure, or integrity loss; only DCMTK 3.7.0 is confirmed affected, and the fixed commit adds a 128-level nesting cap. Risk rises specifically where an unattended service converts untrusted XML automatically, which would weaken the local/user-interaction constraints.

This is a denial-of-service-only flaw (CWE-674 uncontrolled recursion) with a moderate vendor CVSS 4.0 score of 6.8. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) tells a consistent story: no confidentiality or integrity impact (VC:N/VI:N), availability-only impact (VA:H), and a LOCAL attack vector requiring passive user interaction (UI:P) - i.e. a victim or service must be induced to convert the attacker's XML file. No EPSS score, no POC, and no CISA KEV listing were provided, so exploitation probability signals are absent; the only exploitation status supportable from the data is 'no public exploit identified at time of analysis.' The signals are internally consistent rather than conflicting, but one nuance deserves scrutiny: the vendor chose AV:L/UI:P (modeling the xml2dcm CLI where an operator runs the conversion), yet the description explicitly warns that 'any service that converts untrusted XML to DICOM with this code' is affected - a network-facing automated conversion service would effectively raise this toward AV:N/UI:N and materially increase real-world exposure. Verify the actual deployment mode with the affected integrator. Net: this is a real but bounded issue - a crash/DoS, not RCE or data exposure - and should be prioritized as a routine patch rather than an emergency, higher only where DCMTK's XML-to-DICOM path is exposed to untrusted input in an unattended service.

An attacker crafts a malicious XML file containing thousands of deeply nested DICOM sequence and item elements and gets it processed by the xml2dcm tool or an application embedding DCMTK's XML-to-DICOM converter. The mutual recursion between parseDataSet() and parseSequence() consumes the call stack until it is exhausted, crashing the process and denying service. No public exploit code is identified at time of analysis, but the crafted-input technique is straightforward; exploitation requires the victim to actually convert the attacker-supplied file (local vector, passive user interaction).