Read the docs
TI-2026-69427 Aliases CVE-2026-44033GHSA-g7gr-959v-68f6

Uncontrolled recursion in DCMTK XML parser allows denial of service

Priority LOW 29CWE-674Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-674.

Summary

The bundled XML parser in OFFIS DCMTK 3.7.0 recurses without limit on deeply nested elements (CWE-674). A local attacker with no privileges can exhaust the stack and crash the process by supplying a crafted XML document that a user must process.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00105 1st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OFFISDCMTK3.7.0—No fix listedCNA
  • DCMTK VendorOFFIS Affected 3.7.0 Fixed in — No fix listed CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*3.7.0—OFFIS
  • cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:* Versions 3.7.0 — ·OFFIS

Remediation

The sources list no fixed version for DCMTK. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-44033
  2. 2026-10-08 Alias added: GHSA-g7gr-959v-68f6
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-09 CVSS score added · Red Hat

References

Patch 1

Advisory 1

  • TI-2026-10943 OFFIS DCMTK ofxml.cc parseFile heap-based overflow CVSS 4.0MEDIUM 5.3
  • TI-2025-08922 DCMTK dcm2img diybrpxt.h memory corruption CVSS 4.0MEDIUM 4.8
  • TI-2022-04568 DCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereference CVSS 4.0MEDIUM 4.8
  • TI-2020-18990 DCMTK dcmqrscp parseQuota stack-based overflow CVSS 4.0MEDIUM 4.8
  • TI-2024-22823 dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. CVSS 3.1MEDIUM 4.3
  • TI-2019-16028 Out-of-bounds write in OFFIS.de DCMTK CVSS 3.1CRITICAL 9.8
See all 35 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences