Which versions of DCMTK Toolkit are affected by CVE-2026-44628?

OFFIS DCMTK's DICOM worklist server (wlmscpfs) contains an unpatched denial-of-service vulnerability affecting healthcare organizations that depend on this component for medical imaging workflows; an…

How to fix or mitigate CVE-2026-44628?

Within 24 hours: Identify all systems running OFFIS DCMTK wlmscpfs; document version numbers and network location, prioritizing production clinical environments. Within 7 days: Implement firewall rules restricting DICOM server ports to known trusted clinical systems; enable process monitoring and automated restart for wlmscpfs; configure alerting for service crashes. Within 30 days: Contact OFFIS directly to confirm patch timeline and interim update frequency; evaluate deployment of a network-based query filter if available from your DICOM infrastructure vendor; document all compensating controls in your clinical systems risk register.

DCMTK Toolkit CVE-2026-44628

Q: What is the CVSS score of CVE-2026-44628?

CVE-2026-44628 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-40412 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-06-30 icscert

GHSA-gh96-6fq7-wjh8

Denial Of Service Memory Corruption Suse Dcmtk Toolkit Offis Dicom

8.7

CVSS 4.0 · Vendor: icscert

Severity by source

Vendor (icscert) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Remote single-query crash with no auth or interaction (AV:N/AC:L/PR:N/UI:N); only availability is impacted (A:H), no confidentiality or integrity loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (icscert).

CVSS VectorVendor: icscert

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 21:17 vuln.today

DescriptionCVE.org

An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.

AnalysisAI

Denial of service in OFFIS DCMTK's DICOM worklist server (wlmscpfs) allows a remote, unauthenticated attacker to crash the service with a single crafted DICOM query when the server is provisioned with a valid Called AE Title, a storage directory, the expected lockfile, and at least one matching worklist record. The flaw stems from a type-confusion condition (CWE-843) and carries a CVSS 4.0 base score of 8.7 driven entirely by high availability impact (VA:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, though it was reported through the ICS-CERT/ICSMA medical-advisory channel.

Technical ContextAI

DCMTK (DICOM Toolkit) is OFFIS e.V.'s widely used open-source implementation of the DICOM medical-imaging standard, providing libraries and command-line servers used in PACS, modality, and worklist infrastructure across healthcare. The affected component is the Modality Worklist server (the wlmscpfs SCP), which answers C-FIND queries against a file-based worklist database keyed by Called AE Title, a storage directory, and a lockfile. The root cause is classified as CWE-843 (Access of Resource Using Incompatible Type - 'type confusion'), meaning the server interprets attacker-influenced query data as an incompatible type during worklist record matching, leading to memory corruption and an unrecoverable crash. The single affected CPE is cpe:2.3:a:offis_dicom:dcmtk_toolkit:*, and the tags (Denial Of Service, Memory Corruption) confirm the impact class is service crash via memory corruption rather than code execution.

RemediationAI

Upgrade DCMTK to the fixed upstream release referenced by OFFIS - the provided reference points to the DCMTK GitHub releases page (https://github.com/DCMTK/dcmtk/releases/tag/latest), which is a release-tracking link rather than a tagged version number, so the released patched version is not independently confirmed from the input; consult CISA ICSMA-26-181-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01) and its CSAF file to obtain the exact patched build before deploying. Until a confirmed patched version is applied, restrict network reachability of the worklist SCP: place the wlmscpfs server behind a firewall or VLAN segment so only trusted DICOM modalities/AE Titles can reach its listening port, and enforce DICOM TLS plus AE-Title allow-listing where supported (trade-off: tightening AE-Title acceptance may block legitimate modalities that are not yet enrolled). Because a crash requires at least one matching worklist record and the expected lockfile, operators cannot safely 'empty' the worklist as a control without breaking the clinical function, so network isolation and access restriction are the realistic compensating controls rather than disabling the service.