Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of… (CVE-2026-44035)
Description
An uncontrolled recursion vulnerability exists in the DcmDicomDir::moveRecordToTree() function of OFFIS DCMTK 3.7.0 and certain earlier versions. This flaw allows an attacker to cause a denial of service by triggering stack exhaustion and process crash via a crafted DICOMDIR file with a deeply chained sequence of directory records. Applications that open the DICOMDIR, including dcmgpdir and media viewers built on DCMTK, are affected. The issue has been fixed in a specific commit.
CVSS v3.1
Score 5.5medium
Affected software
pkg:deb/ubuntu/dcmtk?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/dcmtk?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/dcmtk?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/dcmtk?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/dcmtk?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/dcmtk?arch=source&distro=stonkingpkg:deb/ubuntu/dcmtk?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from uncontrolled recursion in the moveRecordToTree() function within dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK version 3.7.0 and several earlier versions. An attacker can craft a DICOMDIR file containing a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute, causing the function to recurse excessively. This leads to stack exhaustion and a denial of service via process crash. The flaw affects any application that processes the vulnerable DICOMDIR files, including dcmgpdir and DCMTK-based media viewers. The vulnerability is addressed by a fix committed in revision ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f.
Potential Impact
Successful exploitation results in denial of service due to stack exhaustion and process crash when processing a maliciously crafted DICOMDIR file. There is no impact on confidentiality or integrity reported. The vulnerability affects availability of affected applications.
Mitigation Recommendations
A fix is available and has been committed (commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f). Users should update to the fixed version of DCMTK to remediate this issue. No additional mitigation steps are indicated by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-44035
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f6772cdf04f6566662b2
Added to database: 10/17/2026, 22:28:07 UTC
Last enriched: 10/18/2026, 01:35:52 UTC
Last updated: 10/18/2026, 01:35:52 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.