Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read() in the dcmdata library of OFFIS DCMTK 3.7.0 allows a remote,… (CVE-2026-44031)

The dcmdata library in OFFIS DCMTK 3.7.0 contains an uncontrolled recursion vulnerability in the DcmSequenceOfItems::read() and DcmItem::read() functions. When processing a DICOM dataset with deeply nested sequences (SQ elements), the recursion can exhaust the stack and crash the process. This vulnerability can be triggered remotely by sending a crafted DICOM dataset in a C-STORE request to affected DICOM services, which parse the dataset before authentication. Local tools that open such files also crash. The vulnerability is addressed by commit 885ff0f10372bd589b5f44cea974f28a3964cb0f, which introduces a configurable limit on sequence nesting depth, defaulting to 64.

An unauthenticated remote attacker can cause a denial of service by sending a specially crafted DICOM dataset with deeply nested sequences to vulnerable DCMTK-based services or by opening such files locally, resulting in stack exhaustion and process crashes. There is no impact on confidentiality or integrity reported.

A fix is available that adds a configurable limit on the sequence nesting depth to prevent uncontrolled recursion. Users should update to a version that includes commit 885ff0f10372bd589b5f44cea974f28a3964cb0f or later. Until patched, avoid processing untrusted deeply nested DICOM datasets.