EUVD-2026-40421
GHSA-69cc-m82h-x8rm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, unauthenticated, low-complexity connection request with no user interaction yields a memory-leak DoS, so AV:N/AC:L/PR:N/UI:N with availability-only impact A:H and C:N/I:N.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.
AnalysisAI
Denial of service in OFFIS DCMTK's storescp DICOM receiver allows an unauthenticated remote attacker to exhaust process memory by repeatedly sending a single crafted connection request (CWE-401 memory leak), eventually crashing the service so it stops accepting connections until an operator manually restarts it. In the default single-process deployment mode the leak accumulates per connection and brings the listener down quickly. CVSS 4.0 scores this 8.7 (High), driven entirely by availability impact; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
DCMTK (DICOM Toolkit) is OFFIS's widely used open-source C++ implementation of the DICOM standard for medical imaging, and storescp is its Storage Service Class Provider - a server that listens for and receives DICOM objects (images/studies) over the network. The root cause is CWE-401 (Missing Release of Memory After Effective Lifetime): each crafted connection request allocates memory that is never freed, so repeated requests cause unbounded growth. Because storescp's default mode handles connections within a single long-lived process rather than forking a child per association, the leaked memory accumulates in the listener process itself, leading to OOM termination of the entire service. The affected component is identified by CPE cpe:2.3:a:offis_dicom:dcmtk_toolkit:*:*:*:*:*:*:*:* with no upper version bound published in the provided data.
RemediationAI
Upgrade DCMTK to the fixed release published by OFFIS on the project's GitHub releases page (https://github.com/DCMTK/dcmtk/releases/tag/latest); the reference points to a 'latest' release tag rather than a pinned version number, so Patch available per vendor advisory - confirm the exact patched version against CISA ICSMA-26-181-01 before deploying, as it is not independently confirmed from the provided data. As compensating controls until patched: run storescp in forked/multi-process mode so leaked memory is reclaimed when each per-association child exits, which bounds impact at the cost of higher per-connection overhead; restrict network reachability of the storescp listening port to known imaging modalities and PACS nodes via firewall/ACL, accepting that this does not stop an attacker already on a trusted VLAN; and add process supervision (systemd auto-restart or a watchdog) to recover automatically after an OOM kill, accepting that this only shortens outages rather than preventing them. Reference CISA advisory ICSMA-26-181-01 for vendor-validated guidance.
More in Dcmtk Toolkit
View allPath traversal in OFFIS DCMTK (DICOM Toolkit) lets a malicious or compromised DICOM server write attacker-controlled fil
Path traversal in OFFIS DCMTK DICOM toolkit lets an unauthenticated network attacker read DICOM Modality Worklist record
Denial of service in OFFIS DCMTK's DICOM worklist server (wlmscpfs) allows a remote, unauthenticated attacker to crash t
Denial of service in OFFIS DCMTK DICOM toolkit allows an unauthenticated remote attacker to exhaust memory by repeatedly
Same weakness CWE-401 – Memory Leak
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today