Medium
Security advisory
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-44035
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 13:03 UTC · Revision 1
Source evidence
Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f.
osv:CVE-2026-44035
Complete source record
{
"id": "54f5b14f95bd262eaf804472bc468472021b5e30324d32f566f07582acf986d4",
"url": "https://osv.dev/vulnerability/CVE-2026-44035",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-44035",
"summary": "Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/libsrc/dcdicdir.cc of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted DICOMDIR file with a deeply chained sequence of directory records linked through the Offset of Referenced Lower-Level Directory Entity attribute. Any application that opens the DICOMDIR is affected, including dcmgpdir and media viewers built on DCMTK. The issue is fixed in commit ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f.",
"evidence": "osv:CVE-2026-44035",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-44035",
"aliases": [
"CVE-2026-44035"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/dcmtk/dcmtk",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f"
},
{
"last_affected": "ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"introduced": "0"
},
{
"last_affected": "ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f"
}
],
"source": "DESCRIPTION"
},
{
"range": [
{
"fixed": "ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"latest",
"DCMTK-3.7.0",
"DCMTK-3.6.9",
"DCMTK-3.6.8",
"DCMTK-3.6.7",
"DCMTK-3.6.5",
"DCMTK-3.6.6",
"DCMTK-3.6.5+_20191213",
"DCMTK-3.6.4",
"DCMTK-3.6.3",
"DCMTK-3.6.2",
"DCMTK-3.6.1_20170228",
"DCMTK-3.6.1_20161102",
"DCMTK-3.6.1_20160630",
"DCMTK-3.6.1_20160216",
"DCMTK-3.6.1_20150924",
"DCMTK-3.6.1_20150629",
"DCMTK-3.6.1_20150217",
"DCMTK-3.6.1_20140617",
"DCMTK-3.6.1_20131114",
"DCMTK-3.6.1_20121102",
"DCMTK-3.6.1_20120831",
"DCMTK-3.6.1_20120515",
"DCMTK-3.6.1_20120222",
"DCMTK-3.6.1_20111208",
"DCMTK-3.6.1_20110922",
"DCMTK-3.6.1_20110707",
"DCMTK-3.6.1_20110519",
"DCMTK-3.6.1_20110225",
"DCMTK-3.6.0",
"DCMTK-3.5.4",
"DCMTK-3.5.3",
"DCMTK-3.5.2a",
"DCMTK-3.5.2",
"DCMTK-3.5.1",
"DCMTK-3.5.0",
"DCMTK-3.4.2",
"DCMTK-3.4.1",
"DCMTK-3.4.0",
"DCMTK-3.3.1",
"DCMTK-3.3.0",
"DCMTK-3.2.1",
"DCMTK-3.2.0",
"DCMTK-3.1.2",
"DCMTK-3.1.1",
"DCMTK-3.1.0",
"CAR96-3.0.2",
"CAR96-3.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44035.json",
"vanir_signatures": [
{
"id": "CVE-2026-44035-41981275",
"digest": {
"threshold": 0.9,
"line_hashes": [
"218787419205302308915679876826273623230",
"313188521855461757775146155935278536127",
"28644949004795700158514531045551521732",
"76210407896640489469334185321208645271",
"100765619530679130962884225394530619231",
"165890995566681968348327248186304530376",
"77649256300809859941479907548409260750",
"55364834258415576301500980363976378537"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f",
"target": {
"file": "dcmdata/include/dcmtk/dcmdata/dcdicdir.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2026-44035-5afdd140",
"digest": {
"length": 600,
"function_hash": "97280948091940267851965045388767850789"
},
"source": "https://github.com/dcmtk/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f",
"target": {
"file": "dcmdata/libsrc/dcdicdir.cc",
"function": "DcmDicomDir::convertLinearToTree"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44035-bdd78e54",
"digest": {
"length": 1474,
"function_hash": "90478251126152311946032436047144256325"
},
"source": "https://github.com/dcmtk/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f",
"target": {
"file": "dcmdata/libsrc/dcdicdir.cc",
"function": "DcmDicomDir::moveRecordToTree"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2026-44035-ec139292",
"digest": {
"threshold": 0.9,
"line_hashes": [
"202864451719334378055549567834200278486",
"88507770495682697244498003596909957737",
"98707781534934304700519309253449855359",
"21083351796426142255008590265617105528",
"339279552191811011227856178714658515331",
"319003588736092520741373784498194371931",
"18124815536818951898144939377005446847",
"115945680609718776111827116175513093824",
"48710088312597104099950104676100726883",
"29101391969470832420211840079371192532",
"243263939166994272573577401712100227392",
"7950102325072805054398752029899463096",
"230121865783274837803656725342467613779",
"217066818919507100343590021127979335332",
"208521288584628975896574501715145150274",
"328142814842392646113674970526529396726",
"198105811737775059236094527260321441286",
"230494111643020094089006121428444214088"
]
},
"source": "https://github.com/dcmtk/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f",
"target": {
"file": "dcmdata/libsrc/dcdicdir.cc"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T17:21:11Z"
}
}
],
"modified": "2026-10-20T17:21:11.784184327Z",
"provider": "osv",
"references": [
"https://support.dcmtk.org/redmine/issues/1215",
"https://github.com/DCMTK/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2026-44035",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 389775,
"published_at": "2026-10-08T13:17:17.497+00:00"
}