CVE-2026-44034: CWE-125 Out-of-bounds Read in OFFIS DCMTK

The vulnerability exists in OFFIS DCMTK 3.7.0 within the DcmRLECodecDecoder::decodeFrame() function, which copies 64 bytes from a pixel data fragment without verifying the fragment's length. If the fragment is shorter than 64 bytes, this leads to a heap-based out-of-bounds read of up to 63 bytes or a potential crash. The sibling function decode() performs the necessary length check and is not vulnerable. The dcmdrle command-line tool, which uses decode(), is unaffected. The flaw affects applications decoding RLE images frame by frame, such as those using DcmPixelData::getUncompressedFrame(). The vulnerability is resolved in commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d.

An attacker can exploit this vulnerability by supplying a crafted RLE Lossless DICOM file with an insufficient pixel data fragment length, causing the application to read adjacent heap memory (up to 63 bytes) or crash. This can lead to information disclosure or denial of service. The CVSS 4.0 base score is 4.8 (medium severity), reflecting local attack vector, low complexity, no privileges required, and limited confidentiality and availability impact.

A fix is available and has been applied in commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d. Users of OFFIS DCMTK should update from version 3.7.0 to a version that includes this commit. No additional mitigations are indicated by the vendor advisory.