Description
DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.
References7
- github.com/DCMTK/dcmtk
- github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d42…
- github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d42…
- github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d8…
- github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b81…
- support.dcmtk.org/redmine/issues/1281
- www.vulncheck.com/advisories/dcmtk-through-3.7.0-heap-over-read…
Metrics
- CVSS 3.1
-
8.2
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H - CVSS 4.0
-
8.8
HIGH
Score source: CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - EPSS — exploit probability
- 0% percentile: 28 · as of 9 November 2026
- CWE
- CWE-125
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.