CVE-2026-44036 OFFIS CVE debrief

Who should care

Defenders of systems using DCMTK 3.7.0, especially those handling untrusted XML input, should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of affected deployments.

Why it matters

CVE-2026-44036 is a medium-severity vulnerability in DCMTK's xml2dcm tool that can lead to denial-of-service. Defenders of systems using DCMTK 3.7.0, especially those handling untrusted XML input, should assess exposure and prioritize remediation. The fix is available in commit 87f256d73e30656a822bf7d76d1cf1d9bb693954.

• Potential denial-of-service due to stack exhaustion and process crash.
• Need to verify exposure of DCMTK 3.7.0 deployments.
• Remediation priority for affected systems.

Technical summary

The DCMTK xml2dcm tool is vulnerable to denial of service due to uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence(). This can be exploited via a crafted XML file with deeply nested sequence and item elements. The vulnerability affects DCMTK 3.7.0 and is fixed in commit 87f256d73e30656a822bf7d76d1cf1d9bb693954. Defenders should assess exposure and prioritize remediation for affected systems, especially those handling untrusted XML input. The fix should be verified by applying the patch.

Defensive priority

Medium priority for systems using DCMTK 3.7.0, especially those handling untrusted XML input.

Recommended defensive actions

• Assess exposure of DCMTK 3.7.0 deployments, especially those handling untrusted XML input.
• Prioritize remediation for affected systems.
• Verify fixes by applying the patch from commit 87f256d73e30656a822bf7d76d1cf1d9bb693954.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, its impact, and the fix. However, additional information on affected deployments and potential mitigations is limited. Defenders should verify exposure of DCMTK 3.7.0 deployments, especially those handling untrusted XML input. The CVE Program record and NVD detail page provide official vulnerability metadata. The fix commit reference from DCMTK is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.