CVE-2026-22879

Deferred Deferred - Pending Action

Heap-based Buffer Overflow in VTK vtk-dicom

Publication date: 2026-06-25

Last updated on: 2026-09-23

Assigner: Talos

Description

A heap-based buffer overflow vulnerability exists in the vtkDICOMItem::FindDataElementOrInsert functionality of vtk-dicom (version(s): 9.5.2). A specially crafted DICOM file can lead to heap-based memory corruption. An attacker can provide a malicious file to trigger this vulnerability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-25

Last Modified

2026-09-23

Generated

2026-10-06

AI Q&A

2026-06-26

EPSS Evaluated

2026-10-04

NVD

CVE-2026-22879

EUVD

EUVD-2026-39582

Affected Vendors & Products

Vendor	Product	Version / Range
vtk	vtk	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-129	The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-based buffer overflow in the vtkDICOMItem::NewDataElement function of the vtk-dicom component in vtk. A buffer overflow occurs when more data is written to a buffer than it can hold, potentially leading to memory corruption.

Detection Guidance

This vulnerability is triggered by processing a specially crafted DICOM file that causes heap corruption and results in a SIGABRT error with a "corrupted size vs.prev_size" message in the glibc malloc implementation.

Detection can involve monitoring for application crashes or abnormal termination signals (SIGABRT) when handling DICOM files, especially errors related to heap corruption.

Specific commands to detect this vulnerability are not provided in the available resources.

Impact Analysis

The vulnerability has a high severity with a CVSS base score of 8.1, indicating it can have a significant impact. It can lead to complete compromise of confidentiality, integrity, and availability of the affected system since it allows remote attackers to execute code or cause denial of service due to the heap-based buffer overflow.

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Mitigation Strategies

The available information does not specify immediate mitigation steps such as patches, configuration changes, or workarounds.

General best practices would include avoiding processing untrusted or specially crafted DICOM files with the vulnerable vtk-dicom library version 9.5.2 until a fix is applied.

Hi! I’m here to help you understand CVE-2026-22879. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70