EUVD-2026-38191
GHSA-35pp-gpq2-4898
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered crafted file requires passive user parsing (UI:R); no privileges needed; impact capped at Low across C/I/A consistent with vendor's CVSS 4.0 assessment and limited scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a manipulation can lead to heap-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. This patch is called 1d4b3815c0987840a983160bfc671fef63a3105b. It is best practice to apply a patch to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
AnalysisAI
Heap-based buffer overflow in OFFIS DCMTK's XMLNode::parseFile function (ofstd/libsrc/ofxml.cc) affects all versions through 3.7.0, exploitable by any remote party who can supply a crafted or non-seekable XML input to the parser. The root cause - confirmed by the upstream patch commit - is that the original guard if (!l) failed to catch a -1 return from ftell(), allowing a corrupted buffer size to propagate into heap allocation and subsequent write. A public proof-of-concept exploit exists per VulDB and a published Medium writeup; no active exploitation is confirmed via CISA KEV. The CVSS 4.0 score of 2.1 reflects passive-interaction and low-impact ratings, but the presence of public exploit code elevates practical risk for any DCMTK deployment that parses externally influenced XML files.
Technical ContextAI
OFFIS DCMTK (DICOM Toolkit) is a widely deployed open-source C++ library used to build DICOM-compliant medical imaging applications, PACS servers, and radiology workstations. The vulnerability resides in the ofstd library's XMLNode::parseFile function (ofstd/libsrc/ofxml.cc), which uses ftell() to determine file size before allocating a heap buffer and reading file content into it. The patch commit (1d4b3815c0987840a983160bfc671fef63a3105b) changes the check from if (!l) to if (l <= 0) with the comment 'handle situation where ftell() returns -1.' On POSIX systems, ftell() returns -1 when the file descriptor is a pipe, socket, character device, or otherwise non-seekable stream. When -1 is not caught and is implicitly converted to a large unsigned size type, the subsequent heap allocation either succeeds with a wildly incorrect size or triggers an integer wrap, and the following file-read operation overwrites memory beyond the allocated region - a classic CWE-122 heap-based buffer overflow. The CPE string cpe:2.3:a:offis:dcmtk:*:*:*:*:*:*:*:* confirms the flaw spans the entire DCMTK product line across all versions.
RemediationAI
Apply the upstream patch commit 1d4b3815c0987840a983160bfc671fef63a3105b, available at https://github.com/DCMTK/dcmtk/commit/1d4b3815c0987840a983160bfc671fef63a3105b and the authoritative DCMTK repository at https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=1d4b3815c0987840a983160bfc671fef63a3105b. The vendor is noted to have released a fixed version; however, the exact patched release version number is not independently confirmed from available data - only the commit is verified (upstream fix available at commit level; released patched version not independently confirmed). As a compensating control prior to patching, restrict DCMTK deployments from invoking XMLNode::parseFile with input derived from non-regular files (pipes, sockets, character devices) or from untrusted external sources; enforce application-layer input validation to accept only regular, seekable files before passing them to the XML parser. Note that restricting file source types may impact DICOM XML interoperability with external imaging systems in networked PACS environments. Additionally, deploy DCMTK applications with OS-level heap hardening (ASLR enabled, position-independent executables) to reduce exploitability if patching is delayed.
OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. Rated critical severity (CVSS 9.8), this vulnerability i
Stack-based buffer overflow in the parsePresentationContext function in storescp in DICOM dcmtk-3.6.0 and earlier allows
Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method
An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS D
DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object. Rated high severity (CVSS 7.5), t
(1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprsc
OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing
OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an at
dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. Rated medium severity (CVSS 5.3), t
dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. Rated medium severity (CVSS 4.3), th
A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial
OS command injection in OFFIS DCMTK's storescp utility (versions up to 3.7.0) allows unauthenticated remote attackers to
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today