A flaw was found in DCMTK. This heap over-read vulnerability exists in the ConcatenationLoader component, where it copies pixel data frames without properly validating the buffer length against the declared number of frames. A remote attacker could exploit this by crafting malicious Digital Imaging and Communications in Medicine (DICOM) instances. This could lead to an application crash, resulting in a denial of service, or potentially leak sensitive information from adjacent memory.
Last checked: 2026-09-30 21:40 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 19:38 UTC)
Fix evidence last checked: 2026-09-24 18:26 UTC