{"id":"CVE-2026-44034","state":"PUBLISHED","title":"Heap out-of-bounds read in DCMTK RLE decodeFrame()","description":"A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RLE header. The function copies 64 bytes without checking the fragment length, a check that the sibling function decode() already performs. Applications that decode RLE images frame by frame (for example, through DcmPixelData::getUncompressedFrame()) are affected. The dcmdrle command-line tool uses decode() and is not affected. The issue is fixed in commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d.","publishedAt":"2026-10-08T12:55:09.201Z","updatedAt":"2026-10-08T14:09:23.670Z","severity":{"score":4.8,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","source":"securin"},"assigner":"securin","products":["OFFIS DCMTK"],"affected":[{"vendor":"OFFIS","product":"DCMTK","defaultStatus":"unknown","versions":[{"version":"3.7.0","status":"affected"}],"collectionURL":"https://github.com/DCMTK/dcmtk","repo":"https://github.com/DCMTK/dcmtk","modules":["dcmdata"],"programFiles":["dcmdata/libsrc/dcrleccd.cc"],"cpes":["cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*"]}],"references":["https://support.dcmtk.org/redmine/issues/1213","https://github.com/DCMTK/dcmtk/commit/45469f3c30037e9c7159290e4bb74cd7b3b9ef1d"],"weaknesses":["CWE-125"],"ingestedAt":"2026-10-29T20:11:57.932Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/44xxx/CVE-2026-44034.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-44034","state":"PUBLISHED","datePublished":"2026-10-08T12:55:09.201Z","dateUpdated":"2026-10-08T14:09:23.670Z","assignerShortName":"securin","assignerOrgId":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","dateReserved":"2026-05-05T02:49:00.667Z"},"containers":{"cna":{"title":"Heap out-of-bounds read in DCMTK RLE decodeFrame()","descriptions":[{"lang":"en","value":"A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RLE header. The function copies 64 bytes without checking the fragment length, a check that the sibling function decode() already performs. Applications that decode RLE images frame by frame (for example, through DcmPixelData::getUncompressedFrame()) are affected. The dcmdrle command-line tool uses decode() and is not affected. The issue is fixed in commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d."}],"affected":[{"vendor":"OFFIS","product":"DCMTK","defaultStatus":"unknown","versions":[{"version":"3.7.0","status":"affected"}],"collectionURL":"https://github.com/DCMTK/dcmtk","repo":"https://github.com/DCMTK/dcmtk","modules":["dcmdata"],"programFiles":["dcmdata/libsrc/dcrleccd.cc"],"cpes":["cpe:2.3:a:offis:dcmtk:3.7.0:*:*:*:*:*:*:*"]}],"references":[{"url":"https://support.dcmtk.org/redmine/issues/1213","name":"DCMTK issue #1213","tags":["issue-tracking","vendor-advisory"]},{"url":"https://github.com/DCMTK/dcmtk/commit/45469f3c30037e9c7159290e4bb74cd7b3b9ef1d","name":"Fix commit","tags":["patch"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N","baseScore":4.8,"baseSeverity":"MEDIUM"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","baseScore":4.4,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-125","lang":"en","type":"CWE","description":"CWE-125 Out-of-bounds Read"}]}],"providerMetadata":{"shortName":"securin","orgId":"33c584b5-0579-4c06-b2a0-8d8329fcab9c","dateUpdated":"2026-10-08T12:55:09.201Z"},"solutions":[{"lang":"en","value":"Update to a DCMTK version that contains commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d. As of the publication date, no tagged release after DCMTK 3.7.0 includes this fix, so apply the commit or build from the current master branch."}],"credits":[{"lang":"en","value":"Arjun Basnet from Securin","type":"finder"}],"timeline":[{"time":"2026-05-25T00:00:00.000Z","lang":"en","value":"CVE ID shared with the vendor"},{"time":"2026-05-23T00:00:00.000Z","lang":"en","value":"Fix committed by the vendor"},{"time":"2026-06-19T00:00:00.000Z","lang":"en","value":"Vendor approved publication"}],"source":{"discovery":"EXTERNAL"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-10-08T14:09:13.036801Z","id":"CVE-2026-44034","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-08T14:09:23.670Z"}}]}}}