{"id":"CVE-2026-97059","summary":"DCMTK through 3.7.0 Heap Over-read via NumberOfFrames","details":"DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.","modified":"2026-09-26T08:04:13.287267Z","published":"2026-09-24T13:52:00.194Z","database_specific":{"cna_assigner":"VulnCheck","cwe_ids":["CWE-125"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97059.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97059.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97059"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/dcmtk-through-3.7.0-heap-over-read-via-numberofframes"},{"type":"REPORT","url":"https://support.dcmtk.org/redmine/issues/1281"},{"type":"FIX","url":"https://github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285"},{"type":"FIX","url":"https://github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1"},{"type":"PACKAGE","url":"https://github.com/DCMTK/dcmtk"},{"type":"ARTICLE","url":"https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L334-L360"},{"type":"ARTICLE","url":"https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L399-L430"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/dcmtk/dcmtk","events":[{"introduced":"0"},{"fixed":"ccfd10b84ff3c9a40b7b331698aedf06d421fc43"},{"fixed":"18379d5b8d234977cc30644e9e70d76d89c87285"},{"fixed":"c33790827a192a598d20463af701a8b819f46ec1"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.7.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["latest-tmp","latest","DCMTK-3.7.0","DCMTK-3.6.9","DCMTK-3.6.8","DCMTK-3.6.7","DCMTK-3.6.5","DCMTK-3.6.6","DCMTK-3.6.5+_20191213","DCMTK-3.6.4","DCMTK-3.6.3","DCMTK-3.6.2","DCMTK-3.6.1_20170228","DCMTK-3.6.1_20161102","DCMTK-3.6.1_20160630","DCMTK-3.6.1_20160216","DCMTK-3.6.1_20150924","DCMTK-3.6.1_20150629","DCMTK-3.6.1_20150217","DCMTK-3.6.1_20140617","DCMTK-3.6.1_20131114","DCMTK-3.6.1_20121102","DCMTK-3.6.1_20120831","DCMTK-3.6.1_20120515","DCMTK-3.6.1_20120222","DCMTK-3.6.1_20111208","DCMTK-3.6.1_20110922","DCMTK-3.6.1_20110707","DCMTK-3.6.1_20110519","DCMTK-3.6.1_20110225","DCMTK-3.6.0","DCMTK-3.5.4","DCMTK-3.5.3","DCMTK-3.5.2a","DCMTK-3.5.2","DCMTK-3.5.1","DCMTK-3.5.0","DCMTK-3.4.2","DCMTK-3.4.1","DCMTK-3.4.0","DCMTK-3.3.1","DCMTK-3.3.0","DCMTK-3.2.1","DCMTK-3.2.0","DCMTK-3.1.2","DCMTK-3.1.1","DCMTK-3.1.0","CAR96-3.0.2","CAR96-3.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-97059.json","vanir_signatures_modified":"2026-09-26T08:04:13Z","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["189054512187754188500265921246954181666","37355028741168595404033283392914441623","68216638181973390636758541360100541353","295680123339862348835287464448119931779","55665165073794625829118000143215897691"],"threshold":0.9},"id":"CVE-2026-97059-1104f786","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1","target":{"file":"dcmiod/include/dcmtk/dcmiod/iodutil.h"}},{"id":"CVE-2026-97059-111200df","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285","target":{"file":"dcmfg/libsrc/concatenationloader.cc","function":"ConcatenationLoader::extractFrames"},"deprecated":false,"digest":{"function_hash":"313932792357932266299213235075968446283","length":1382}},{"deprecated":false,"digest":{"line_hashes":["175421237151518130194930337078644155902","248700311908366036796816638311046079684","231773050952347372169018175388261732002","119115726292928995915424732389840435233"],"threshold":0.9},"id":"CVE-2026-97059-16ff9c29","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285","target":{"file":"dcmfg/tests/tests.cc"}},{"id":"CVE-2026-97059-18ed82f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285","target":{"function":"ConcatenationLoader::extractBinaryFrames","file":"dcmfg/libsrc/concatenationloader.cc"},"deprecated":false,"digest":{"function_hash":"68758409079852840770650801104303969794","length":460}},{"target":{"file":"dcmseg/libsrc/segdoc.cc","function":"DcmSegmentation::readPixelData"},"deprecated":false,"digest":{"function_hash":"199411693895837464749964238021075961398","length":1325},"id":"CVE-2026-97059-4a4808f0","signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1"},{"digest":{"line_hashes":["197555816138725945051474825314445511783","14315158308059081314620327930036921717","81483838159574820148840622963688140995","147055784919101753053813450836785975165","216968408098448563333228956476292547578","272724539119513591856579214308913173355"],"threshold":0.9},"id":"CVE-2026-97059-61001226","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1","target":{"file":"dcmseg/tests/tutils.cc"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285","target":{"file":"dcmfg/libsrc/concatenationloader.cc","function":"ConcatenationLoader::computeBytesPerFrame"},"deprecated":false,"digest":{"function_hash":"117808250900438243212786854904546350691","length":505},"id":"CVE-2026-97059-693cba62"},{"target":{"file":"dcmfg/libsrc/concatenationloader.cc"},"deprecated":false,"digest":{"line_hashes":["71710132755663374887579546063364340407","298610517410357507503507833860951402764","199759772965501187734126588758576988209","320294275506493295468447304136896484064","227740234489249417576211054360206434249","123466870345042174474572581221366822775","166479527404694624625221227695682866445","172192014766490798623645269094684507015","111640668741375472372830421866970503025","334889320593356217246214249911838575854","13258310933401624744409991355862584628","132209086173582071968962309611022071993","99044631194986009915570035082444949199","267656130074676565372346750784084331075","18429032686408202716376903785323556867","211696742959624476313442935557371509121","20189606737363324487374450577907553203","228652176601273396697160850956380373750","98926860398982531264744838468869782500","327230153724944061118560741951231683297","150095601401120862921742953754875599571","40570807198286052339676937320886767204","257767470777445736125755220197954654593","175453302251506580406222554646853427099"],"threshold":0.9},"id":"CVE-2026-97059-ba7b351b","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285"},{"signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1","target":{"file":"dcmiod/libsrc/iodutil.cc"},"deprecated":false,"digest":{"line_hashes":["70613568748420820768644879651071852396","99587376586778104982682620426086420374","40303627100164357341750126754538324523","131400857967491653988607447649877725669","170352994121776726989639610703633563200","96306764901920650675201507006615398810","41605182163716060150054023998539854742","29280370250874990048519857154304605821","304306985029766796410682534734429182721","248357387936342051553912542718578204379","311069119210870908443412714639717899872","263110744355587531588641254747934354107"],"threshold":0.9},"id":"CVE-2026-97059-d5a05fcc","signature_type":"Line"},{"digest":{"line_hashes":["33870819926300791377827011560682341917","40403640893067945945052173741779364756","261728558658693671812207298411430985091","137297124346422509804618967520846307908","21196347966870225584751676961319684143","281044181964705370533682061399301387249","58395638584202594637577664756372830088","8135481889067952925988559828138125688"],"threshold":0.9},"id":"CVE-2026-97059-dad80d72","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285","target":{"file":"dcmfg/tests/t_concatenation_loader.cc"},"deprecated":false},{"id":"CVE-2026-97059-f789ac10","signature_type":"Line","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1","target":{"file":"dcmseg/libsrc/segdoc.cc"},"deprecated":false,"digest":{"line_hashes":["77750669833813791926616277891953778831","205601216290566461950220279991550713126","192605630930658553147904690774190786721","287199064607018099743692896705044121094"],"threshold":0.9}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/dcmtk/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1","target":{"file":"dcmseg/tests/tutils.cc","function":"OFTEST"},"deprecated":false,"digest":{"function_hash":"205713040766523763858944728864375690418","length":2001},"id":"CVE-2026-97059-fdb102f7"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N"}]}