CVE-2026-50254

Received Received - Intake

Memory Leak in DICOM Storescp via Crafted Request

Publication date: 2026-06-30

Last updated on: 2026-06-30

Assigner: ICS-CERT

Description

An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp in its default single-process mode, memory grows quickly and the service is eventually killed, after which it stops accepting connections until an operator restarts it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-30

Last Modified

2026-06-30

Generated

2026-07-01

AI Q&A

2026-07-01

EPSS Evaluated

N/A

NVD

CVE-2026-50254

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Attack-Flow Graph

Executive Summary

This vulnerability allows an unauthenticated remote attacker to repeatedly send a specially crafted connection request to the storescp service running in its default single-process mode.

As a result, the memory usage of the service grows quickly, eventually causing the service to be killed.

Once killed, the service stops accepting connections until an operator manually restarts it.

Impact Analysis

The impact of this vulnerability is a denial of service condition.

Because the storescp service's memory grows rapidly and is eventually killed, it stops accepting connections, disrupting normal operations.

This disruption continues until an operator restarts the service, potentially causing downtime and loss of availability.

Hi! I’m here to help you understand CVE-2026-50254. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70