CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 10:23 UTC )
This week: 5,468 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,468 Show in the list Critical, last 7 days 357 Show in the list Healthcare-tagged, last 7 days 4 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product offis:dcmtk . Show all products
36 CVEs, showing 1 to 36
CVE Severity Title Published CVE-2026-44038 Healthcare
Medium 4.4 Global buffer out-of-bounds read in DCMTK JPEG Huffman decoding Assigned by securin
Oct 8, 2026 CVE-2026-44037 Healthcare
Medium 5.5 Uncontrolled recursion in DCMTK JSON reader allows denial of service Assigned by securin
Oct 8, 2026 CVE-2026-44036 Healthcare
Medium 5.5 Uncontrolled recursion in DCMTK xml2dcm allows denial of service Assigned by securin
Oct 8, 2026 CVE-2026-44035 Healthcare
Medium 5.5 Uncontrolled recursion in DCMTK DICOMDIR parsing allows denial of service Assigned by securin
Oct 8, 2026 CVE-2026-44034 Healthcare
Medium 4.4 Heap out-of-bounds read in DCMTK RLE decodeFrame() Assigned by securin
Oct 8, 2026 CVE-2026-44033 Healthcare
Medium 5.5 Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service Assigned by securin
Oct 8, 2026 CVE-2026-44031 Healthcare
High 7.5 Uncontrolled recursion in the DCMTK DICOM dataset parser allows unauthenticated remote denial of service Assigned by securin
Oct 8, 2026 CVE-2026-97059 Healthcare
High 8.2 DCMTK through 3.7.0 Heap Over-read via NumberOfFrames Assigned by VulnCheck
Sep 24, 2026 CVE-2026-12805 Healthcare
Medium 6.3 OFFIS DCMTK ofxml.cc parseFile heap-based overflow Assigned by VulDB
Jun 21, 2026 CVE-2026-10194 Healthcare
Medium 6.3 OFFIS DCMTK dcmqrscp dcmqrdbi.cc deleteOldestImages heap-based overflow Assigned by VulDB
May 31, 2026 CVE-2026-5663 Healthcare
High 7.3 OFFIS DCMTK storescp storescp.cc executeOnEndOfStudy os command injection Assigned by VulDB
Apr 6, 2026 CVE-2025-14841 Healthcare
Low 3.3 OFFIS DCMTK dcmqrscp dcmqrdbi.cc startMoveRequest null pointer dereference Assigned by VulDB
Dec 18, 2025 CVE-2025-14607 Healthcare
Medium 6.3 OFFIS DCMTK dcmdata dcbytstr.cc makeDicomByteString memory corruption Assigned by VulDB
Dec 13, 2025 CVE-2022-4981 Healthcare
Low 3.3 DCMTK dcmqrscp dcmqrcnf.cc readPeerList null pointer dereference Assigned by VulDB
Oct 21, 2025 CVE-2020-36855 Healthcare
Medium 5.3 DCMTK dcmqrscp parseQuota stack-based overflow Assigned by VulDB
Oct 21, 2025 CVE-2025-9732 Healthcare
Medium 5.3 DCMTK dcm2img diybrpxt.h memory corruption Assigned by VulDB
Aug 31, 2025 CVE-2025-2357 Healthcare
Medium 6.3 DCMTK dcmjpls JPEG-LS Decoder memory corruption Assigned by VulDB
Mar 17, 2025 CVE-2025-25475 Healthcare
High 7.5 A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DICOM file. Assigned by mitre
Feb 18, 2025 CVE-2025-25474 Healthcare
Medium 6.5 DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h. Assigned by mitre
Feb 18, 2025 CVE-2025-25472 Healthcare
Medium 5.3 A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file. Assigned by mitre
Feb 18, 2025 CVE-2024-52333 Healthcare
High 8.4 An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. Assigned by talos
Jan 13, 2025 CVE-2024-47796 Healthcare
High 8.4 An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. Assigned by talos
Jan 13, 2025 CVE-2024-27628 Healthcare
High 8.1 Buffer Overflow vulnerability in DCMTK v.3.6.8 allows an attacker to execute arbitrary code via the EctEnhancedCT method component. Assigned by mitre
Jun 28, 2024 CVE-2024-34509 Healthcare
Medium 5.3 dcmdata in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. Assigned by mitre
May 5, 2024 CVE-2024-34508 Healthcare
Medium 4.3 dcmnet in DCMTK before 3.6.9 has a segmentation fault via an invalid DIMSE message. Assigned by mitre
May 5, 2024 CVE-2024-28130 Healthcare
High 7.5 An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI_PList::createFromImage functionality of OFFIS DCMTK 3.6.8. Assigned by talos
Apr 23, 2024 CVE-2022-43272 Healthcare
High 7.5 DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object. Assigned by mitre
Dec 2, 2022 CVE-2021-41687 Healthcare
High 7.5 DCMTK through 3.6.6 does not handle memory free properly. Assigned by mitre
Jun 28, 2022 CVE-2021-41688 Healthcare
High 7.5 DCMTK through 3.6.6 does not handle memory free properly. Assigned by mitre
Jun 28, 2022 CVE-2021-41690 Healthcare
High 7.5 DCMTK through 3.6.6 does not handle memory free properly. Assigned by mitre
Jun 28, 2022 CVE-2021-41689 Healthcare
High 7.5 DCMTK through 3.6.6 does not handle string copy properly. Assigned by mitre
Jun 28, 2022 CVE-2022-2119 Healthcare
High 7.5 OFFIS DCMTK Path Traversal Assigned by icscert
Jun 24, 2022 CVE-2022-2121 Healthcare
High 7.5 OFFIS DCMTK NULL Pointer Dereference Assigned by icscert
Jun 24, 2022 CVE-2022-2120 Healthcare
High 7.5 OFFIS DCMTK Path Traversal Assigned by icscert
Jun 24, 2022 CVE-2019-1010228 Healthcare
Critical 9.8 OFFIS.de DCMTK 3.6.3 and below is affected by: Buffer Overflow. Assigned by dwf
Jul 22, 2019 CVE-2013-6825 Healthcare
High 7.2 (1) movescu.cc and (2) storescp.cc in dcmnet/apps/, (3) dcmnet/libsrc/scp.cc, (4) dcmwlm/libsrc/wlmactmg.cc, (5) dcmprscp.cc and (6) dcmpsrcv.cc in dcmpstat/apps/, (7) dcmpstat/tests/msgserv.cc, and… Assigned by mitre
Jun 10, 2014
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
