CVE-2026-97059CWE-125

CVE-2026-97059

High · published September 24, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CVSS v4.0
8.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00347 · 27.1th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-09-24T18:18Z
References (7)
https://github.com/DCMTK/dcmtk · [email protected]https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L334-L360 · [email protected]https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L399-L430 · [email protected]https://github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285 · [email protected]https://github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1 · [email protected]https://support.dcmtk.org/redmine/issues/1281 · [email protected]https://www.vulncheck.com/advisories/dcmtk-through-3.7.0-heap-over-read-via-numberofframes · [email protected]
EPSS history
Timeline
  • 26 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 24 SEP 13:52Z
    DCMTK through 3.7.0 Heap Over-read via NumberOfFrames
    cvelistv5