CVE-2026-44035 OFFIS CVE debrief

Who should care

Defenders responsible for systems and applications built with DCMTK 3.7.0, particularly those handling DICOMDIR files, should assess exposure and apply the patch or other compensating controls to prevent potential denial-of-service attacks.

Why it matters

CVE-2026-44035 is a medium-severity vulnerability in DCMTK 3.7.0 that allows denial-of-service attacks through uncontrolled recursion in DICOMDIR parsing. Defenders should assess exposure, apply patches or compensating controls, and monitor for potential attacks.

• Potential denial-of-service attacks through crafted DICOMDIR files
• Verification of DCMTK 3.7.0 installations and exposure
• Remediation priority for affected systems and applications

Technical summary

The vulnerability exists in the DcmDicomDir::moveRecordToTree() function in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0. An attacker can cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f. Defenders should assess exposure, apply patches or compensating controls, and monitor for potential attacks.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch from the fix commit
• Inventory and assess exposure of DCMTK 3.7.0 installations
• Monitor for and restrict malicious DICOMDIR files
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the corpus does not establish exploitation or impact, and remediation requires verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.