CVE-2026-12805 is a heap-based buffer overflow vulnerability affecting OFFIS DCMTK up to version 3.7.0. The issue resides in the XMLNode::parseFile function in the ofstd/libsrc/ofxml.cc library file. An attacker can remotely manipulate inputs to trigger this overflow, potentially causing memory corruption. The vendor was contacted early and responded professionally by releasing a fixed version quickly. The patch is identified by commit 1d4b3815c0987840a983160bfc671fef63a3105b. No explicit remediation level or patch link is provided in the data, but the vendor's release of a fixed version indicates an official fix is available.

Successful exploitation of this vulnerability can lead to heap-based buffer overflow, which may result in memory corruption. This can cause application instability or potentially allow an attacker to execute arbitrary code or crash the application. The vulnerability is remotely exploitable without privileges or user interaction, but the overall impact is rated medium.

A fixed version of OFFIS DCMTK has been released by the vendor following the discovery of this vulnerability. It is recommended to update to the patched version that includes commit 1d4b3815c0987840a983160bfc671fef63a3105b. Since the vendor has promptly released a fix, applying this official patch is the primary mitigation. Patch status is not explicitly confirmed in the advisory, so verify the vendor's latest release notes or advisories for the exact fixed version.