CVE-2026-44033
Received Received - Intake

Uncontrolled Recursion in DCMTK XML Parser

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: securin

Description
Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-44033
EUVD
EUVD-2026-94936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OFFIS DCMTK 3.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves uncontrolled recursion in the XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() functions of the OFFIS DCMTK 3.7.0 XML parser. An attacker can exploit it by providing a crafted XML document with deeply nested elements, causing stack exhaustion and a process crash.

Detection Guidance

To detect this vulnerability, monitor for crashes in applications using DCMTK's XML parser (e.g., dcmencap) when processing XML files. Check for stack overflow errors or process termination during XML parsing tasks. No specific commands are provided in the context, but inspecting logs for crashes during XML file handling may indicate exploitation.

Impact Analysis

The vulnerability can lead to a denial of service (DoS) by crashing applications that process untrusted XML input. Applications using OFXMLParser::parseFile() or OFXMLParser::parseString() are affected, including dcmencap when handling CDA documents.

Compliance Impact

This vulnerability causes a denial of service via stack exhaustion, which could disrupt systems processing XML documents. For GDPR, this may impact availability of personal data processing. For HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Update DCMTK to the latest version that includes the fix (commit d12e350e687530eb41e2b0c860aff4d8c04e5941). If updating is not possible, restrict access to applications using OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. Validate and sanitize all XML input to prevent deeply nested elements.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44033. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart