DCMTK EUVD-2026-94941

Exploitation requires a victim to decompress a crafted JPEG-encoded DICOM file with DCMTK 3.7.0 - specifically a JPEG stream whose Huffman table defines a difference category (SSSS) greater than 15, which is undefined per ISO 10918-1 and drives the out-of-bounds index. The flaw affects default builds because the range-check guard (DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK) is disabled by default; builds that explicitly enable it are NOT vulnerable. Affected entry points include dcmdjpeg and any application that decompresses JPEG DICOM images via the bundled libijg8/12/16 libraries. Limiting factors: attack vector is local (AV:L) - the attacker must deliver the file and the victim must open/process it (UI:P / passive user interaction), there is no network-reachable trigger, no code-execution or integrity impact, and the information disclosure is bounded to memory adjacent to small static lookup tables.

This is a genuinely low-to-moderate priority issue, and the multiple signals are consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L) scores 4.8 (medium), driven down by the local attack vector and required user interaction, and capped at LOW confidentiality/availability impact - consistent with a global out-of-bounds READ (CWE-125) that leaks a small amount of adjacent static-table memory or crashes the decoder, rather than enabling code execution or memory corruption (VI:N / integrity:none). CISA's SSVC framework agrees across the board: Exploitation=none (no observed attacks), Automatable=no (requires a victim to open a crafted file, not mass-scannable), and Technical Impact=partial. There is no CISA KEV listing and no EPSS score was provided, but given no public exploit and a file-parsing local vector, real-world exploitation probability is low. The one nuance worth flagging to teams: the read is out of bounds of small fixed lookup tables (extend_test[]/extend_offset[]), so the 'information disclosure' is bounded and unlikely to leak high-value secrets - and because strict Huffman checking is off by default, default builds ARE vulnerable, which slightly raises exposure relative to a non-default-only flaw. Net: a real but low-severity bug, appropriately patched, not an emergency.

An attacker crafts a DICOM file containing a JPEG stream whose Huffman table declares a difference (DC) category greater than 15. When a clinician or an automated imaging pipeline decompresses that file with DCMTK (e.g., via dcmdjpeg or any viewer linking the bundled IJG libraries), the Huffman decoder indexes past the extend_test[]/extend_offset[] tables, leaking adjacent static memory into the decoded pixel data or crashing the process. No public exploit code was identified at time of analysis, and exploitation requires the victim to process the attacker-supplied file.