OFFIS DICOM vulnerabilities
Published CVEs affecting OFFIS DICOM products: 5 record(s), with severity, exploitation and fixes.
CVE-2026-52868
High · 8.2
CWE-22 Jun 30, 2026
OFFIS DCMTK Toolkit Path Traversal
An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area deployment, this can cross departmental or clinic data separation.
CVE-2026-50254
High · 7.5
CWE-401 Jun 30, 2026
OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime
An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.
CVE-2026-50003
Critical · 9.8
CWE-22 Jun 30, 2026
DCMTK Path Traversal in C-GET Bit-Preserving Storage Mode (CVE-2026-50003)
A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths.
CVE-2026-35505
High · 7.5
CWE-401 Jun 30, 2026
OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime
An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory. In single-process deployments the memory grows until the service is killed and the port stops responding until restart.
CVE-2026-44628
High · 7.5
CWE-843 Jun 30, 2026
OFFIS DCMTK Toolkit Type Confusion
An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.