PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35505 OFFIS DICOM CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-06-30T06:00:00.000Z and has not been modified since then. OFFIS DCMTK Toolkit is affected by a vulnerability that allows an unauthenticated remote attacker to repeatedly send crafted connection requests to leak memory. In single-process deployments, the memory grows until the service is killed and the port stops responding until restart. The vulnerability affects the handling of incoming connections, potentially allowing attackers to exploit memory management weaknesses. Organizations should review system deployments, assess potential exposure, and prioritize patching or implementing compensating controls where immediate patching is not feasible.

Vendor
OFFIS DICOM
Product
DCMTK
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-30
Original CVE updated
2026-06-30
Advisory published
2026-06-30
Advisory updated
2026-06-30

Who should care

Organizations using OFFIS DCMTK Toolkit, especially those in industrial control systems, healthcare, and medical devices, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes reviewing system deployments, assessing potential exposure, and prioritizing patching or implementing compensating controls where immediate patching is not feasible. Security teams should also monitor for unusual activity and review system logs for potential exploitation attempts.

Technical summary

An unauthenticated remote attacker can repeatedly send crafted connection requests to leak memory in OFFIS DCMTK Toolkit. This can lead to the service being killed and the port stopping to respond until restart in single-process deployments. The vulnerability affects the handling of incoming connections, potentially allowing attackers to exploit memory management weaknesses. The vulnerability is caused by improper handling of memory in the affected product, which can be triggered by repeated crafted connection requests. This can lead to memory leaks and potentially allow attackers to exploit the vulnerability.

Defensive priority

Organizations using OFFIS DCMTK Toolkit should prioritize patching to prevent potential memory leak attacks.

Recommended defensive actions

  • Apply the vendor-provided fix from the latest GitHub release.
  • Implement network segmentation to limit the attack surface.
  • Monitor for unusual connection requests.
  • Restrict access to the affected service.
  • Regularly update and patch the OFFIS DCMTK Toolkit.

Evidence notes

The source advisory from CISA provides details on the vulnerability, including the impact of repeated crafted connection requests leading to memory leaks in single-process deployments of OFFIS DCMTK Toolkit. To verify, defenders should review system logs for unusual connection requests and monitor memory usage. Additional information from vendor sources or ICS-specific alerts may provide further context on affected configurations and potential mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35505 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35505

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35505 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35505

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsma-26-181-01.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-181-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.