Heap Over-Read in DCMTK ConcatenationLoader

Executive Summary

CVE-2026-97059 is a heap over-read vulnerability in DCMTK through version 3.7.0. It occurs in the ConcatenationLoader component when processing DICOM files. The vulnerability arises when the NumberOfFrames tag declares more frames than the actual PixelData buffer contains. This mismatch causes the software to read past the end of the allocated buffer, potentially leading to application crashes or leakage of adjacent heap memory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect DICOM files processed by DCMTK versions before 3.7.1 for mismatches between the NumberOfFrames tag and actual PixelData buffer size. Use DCMTK tools like dcmdump to analyze DICOM headers for malformed frame declarations. Monitor application crashes or memory leaks during DICOM file processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to craft malicious DICOM files that trigger heap over-reads. This may cause the application to crash (denial of service) or expose sensitive memory contents. Systems processing untrusted DICOM files are at risk, particularly those in medical imaging environments where DCMTK is used for handling DICOM data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by potentially exposing sensitive data through heap memory leaks. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. A heap over-read could lead to unauthorized access to adjacent memory, risking data breaches that violate these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade DCMTK to the latest patched version (3.7.1 or later) to address the heap over-read issue. If upgrading is not immediately possible, restrict processing of untrusted DICOM files or implement input validation to reject files declaring more frames than the PixelData buffer contains.

Useful 0 Not Useful 0