CVE-2026-44036
Received Received - Intake

Stack Overflow in DCMTK XML-to-DICOM Converter

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: securin

Description
Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML file with deeply nested sequence and item elements. The xml2dcm tool and any service that converts untrusted XML to DICOM with this code are affected. The issue is fixed in commit 87f256d73e30656a822bf7d76d1cf1d9bb693954.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-44036
EUVD
EUVD-2026-94939

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
OFFIS DCMTK 3.7.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a denial of service issue caused by uncontrolled mutual recursion in the XML-to-DICOM converter of OFFIS DCMTK 3.7.0. When processing a crafted XML file with deeply nested sequence and item elements, the parser enters infinite recursion leading to stack exhaustion and process crash.

Detection Guidance

Monitor for crashes in xml2dcm or services using DCMTK when processing XML files. Check logs for stack overflow errors or EC_NestingDepthLimitExceeded messages. Use tools like strace or gdb to trace recursion depth during XML parsing.

Impact Analysis

The vulnerability allows an attacker to crash the xml2dcm tool or any service converting untrusted XML to DICOM using affected DCMTK code. This results in denial of service, disrupting operations that rely on DICOM processing.

Compliance Impact

This vulnerability causes a denial of service via stack exhaustion, which could disrupt services handling untrusted XML-to-DICOM conversions. For GDPR, this may impact availability of systems processing medical data. For HIPAA, it could lead to service disruptions affecting protected health information access.

Mitigation Strategies

Update DCMTK to a version containing the fix (commit 87f256d73e30656a822bf7d76d1cf1d9bb693954). If immediate update is not possible, restrict access to xml2dcm and validate XML input to prevent deeply nested sequences.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44036. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart