Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK… (CVE-2026-44033)
Description
A vulnerability in the OFFIS DCMTK bundled XML parser allows uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode(), leading to denial of service via stack exhaustion and process crash when processing crafted XML documents with deeply nested elements. This affects multiple specific versions of DCMTK. The issue is fixed in a later commit.
CVSS v3.1
Score 5.5medium
Affected software
pkg:deb/ubuntu/dcmtk?arch=source&distro=esm-apps/xenialpkg:deb/ubuntu/dcmtk?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/dcmtk?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/dcmtk?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/dcmtk?arch=source&distro=esm-apps/noblepkg:deb/ubuntu/dcmtk?arch=source&distro=stonkingpkg:deb/ubuntu/dcmtk?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-44033 describes an uncontrolled recursion vulnerability in the XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() functions within the bundled XML parser of OFFIS DCMTK version 3.6.0-15.1 through 3.7.0+really3.7.0-7ubuntu1. An attacker can cause a denial of service by submitting a crafted XML document containing deeply nested elements, which triggers stack exhaustion and crashes the process. The parser is reachable through the dcmencap tool when encapsulating CDA documents or any application invoking OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The vulnerability is addressed and fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.
Potential Impact
Successful exploitation results in denial of service due to stack exhaustion and process crash. There is no impact on confidentiality or integrity. The attack requires local vector (AV:L) with low complexity and no privileges, but user interaction is required (UI:R).
Mitigation Recommendations
A fix is available and has been committed (commit d12e350e687530eb41e2b0c860aff4d8c04e5941). Users should upgrade to a patched version of DCMTK that includes this fix. Until patched, avoid parsing untrusted XML input with the vulnerable parser functions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-44033
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:Pro:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad3f6772cdf04f6566662b4
Added to database: 10/17/2026, 22:28:07 UTC
Last enriched: 10/18/2026, 01:36:00 UTC
Last updated: 10/18/2026, 01:36:00 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.