OFFIS DCMTK EUVD-2026-94935

No special conditions beyond network reachability of a DICOM service - the malicious dataset is parsed before authentication, so any DCMTK 3.7.0-based service accepting incoming associations (storescp, dcmrecv, dcmqrscp, or custom DICOM SCPs) is exploitable by an unauthenticated remote attacker simply by delivering a dataset with sequence nesting beyond the (previously nonexistent) depth limit. The specific trigger is a DICOM dataset containing deeply nested SQ elements exceeding available call-stack depth. Limiting factors: the attacker must be able to reach the DICOM listening port (often segmented on internal healthcare networks rather than internet-exposed); impact is confined to availability (process crash) with no code execution or data exposure; and the issue is remediated by the patched default 64-level limit or by setting a runtime nesting limit. Local exposure also exists - dcmdump and similar tools crash when opening a crafted file.

This is a genuine but bounded risk. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, and the description reinforces that the malicious dataset is parsed BEFORE authentication in C-STORE handling - a key amplifier because network-facing DICOM services (storescp, dcmrecv, dcmqrscp) can be crashed by anyone who can reach the listening port. However, impact is strictly availability (VA:H, with VC:N/VI:N/VA:H and SC/SI/SA:N): this is a stack-exhaustion crash, not code execution or data disclosure, so the 8.7 score is driven entirely by easy reachability against a high availability impact rather than by compromise potential. No EPSS score, no CISA KEV listing, and no public exploit were provided in the intelligence set, so there is no evidence of active exploitation or widespread weaponization. Net: prioritize patching for internet- or network-exposed DCMTK-based DICOM receivers (unauthenticated pre-auth crash of a medical-imaging service is operationally serious), but treat it as a DoS/availability issue, not a remote-code-execution emergency. Note the only CVSS vector supplied is 4.0; no CVSS 3.1 vector was provided for cross-comparison.

An attacker who can reach a network-exposed DCMTK-based DICOM service (e.g., storescp or dcmqrscp) sends a crafted C-STORE request containing a DICOM dataset with hundreds of deeply nested SQ (sequence) elements. Because the dataset is parsed before any authentication, the recursive DcmSequenceOfItems::read()/DcmItem::read() calls exhaust the call stack and crash the process, denying service to a medical-imaging node. No public exploit code was identified in the provided intelligence, but the trigger file is trivial to construct and also crashes local tools like dcmdump when opened.