Unauthenticated Worklist Server Crash via Crafted Query

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: ICS-CERT

Description

An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-44628

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated attacker to crash the worklist server by sending a single specially crafted query. The attack is effective when the server has a valid Called AE Title or storage directory, the expected lockfile, and at least one matching worklist record.

Impact Analysis

The impact of this vulnerability is a denial of service condition where the worklist server crashes. This can disrupt normal operations and availability of the server, potentially affecting any services or workflows that depend on the worklist server.

Hi! I’m here to help you understand CVE-2026-44628. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70