OFFIS DCMTK: Denial of service via deeply nested DICOM sequences
Summary
The dcmdata library of OFFIS DCMTK 3.7.0 parses DICOM datasets with unlimited recursion for nested sequences (SQ elements). An unauthenticated remote attacker can send a crafted dataset, for example via a C-STORE request to a DCMTK-based DICOM service such as storescp or dcmrecv, to exhaust the stack and crash the process. The dataset is parsed before any authentication takes place, and local tools such as dcmdump also crash on such a file. The impact is denial of service only.
Affected
- OFFIS DCMTK 3.7.0
- Older versions: unconfirmed, the OSV range marks all versions before commit 885ff0f as affected.
Fixed in
- Commit 885ff0f10372bd589b5f44cea974f28a3964cb0f adds a configurable sequence nesting depth limit (default 64).
- No tagged DCMTK release containing the fix was known as of the publication date.
Workaround
- Restrict DICOM ports (default 104 in many setups) to known modality and PACS IP addresses via firewall or VPN.
- Keep DICOM services off the internet.
- Do not open untrusted DICOM files with dcmdump.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact partial.
- No evidence of exploitation in the wild and no public proof of concept found.
- EPSS 0.00391 (Rapid7).
Our recommendation
- Check whether DCMTK-based DICOM services (PACS, archive, storescp, dcmrecv, dcmqrscp) are in use and which version they run.
- Restrict network access to the DICOM ports immediately, especially if any service is reachable from the internet.
- Apply commit 885ff0f or build DCMTK from a master tree that includes it, and check your distribution's fix status.
- Monitor for unexpected service restarts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Upstream fix commit 885ff0f github.com
- DCMTK issue #1191 support.dcmtk.org
- OSV CVE-2026-44031 osv.dev
- Ubuntu CVE-2026-44031 ubuntu.com
- OSV Debian CVE-2026-44031 osv.dev
- Nixpkgs issue 572410 github.com
- VulDB 415357 vuldb.com
- HOL Guard CVE-2026-44031 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:17.
Original description (NVD)
Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote, unauthenticated attacker to cause a denial of service (stack exhaustion and process crash) via a DICOM dataset containing deeply nested sequences (SQ elements). The dataset can be sent in a C-STORE request to storescp, dcmrecv, dcmqrscp, or any other DICOM service built on DCMTK, because the received dataset is parsed before any authentication takes place. Local tools such as dcmdump also crash when opening such a file. The issue is fixed in commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which adds a configurable sequence nesting depth limit (default 64).
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.