OFFIS DCMTK and DICOM Projects

2026-05-25

12:21 DCMTK Bug #1212 (Closed): NULL dereference in json2dcm

Marco Eichelberg

12:15 DCMTK Bug #1210 (Closed): wlmscpfs Called AE Title used as directory path unsanitized

Marco Eichelberg

12:02 DCMTK Bug #1213: RLE decodeFrame() Heap-OOB Read

This issue has been registered as CVE-2026-44034. Marco Eichelberg

12:01 DCMTK Bug #1214: Unbounded recursion in XMLParser library

This issue has been registered as CVE-2026-44033. Marco Eichelberg

12:01 DCMTK Bug #1191: Stack Overflow via Deeply Nested DICOM Sequences

This issue has been registered as CVE-2026-44031. Marco Eichelberg

12:00 DCMTK Bug #1194: OS command injection vulnerability in storescp --exec-on-reception

This issue has been registered as CVE-2026-44030. Marco Eichelberg

2026-05-24

19:22 DCMTK Bug #1214 (Closed): Unbounded recursion in XMLParser library

Closed by commit #d12e350e6.
Marco Eichelberg

19:19 DCMTK Bug #1214 (Closed): Unbounded recursion in XMLParser library

The methods @XMLNode::ParseXMLElement()@ and @XMLNode::emptyTheNode()@ in @ofstd/libsrc/ofxml.cc@ recurse on the stac... Marco Eichelberg

2026-05-23

18:05 DCMTK Bug #1213 (Closed): RLE decodeFrame() Heap-OOB Read

Closed by commit #45469f3c3.
Marco Eichelberg

18:02 DCMTK Bug #1213 (Closed): RLE decodeFrame() Heap-OOB Read

@DcmRLECodecDecoder::decodeFrame()@ (dcmdata/libsrc/dcrleccd.cc:583) calls @memcpy(rleHeader, rleData, 64)@ without v... Marco Eichelberg

2026-05-22

09:30 DCMTK Feature #1146 (Closed): Add character set options to dcm2json

Marco Eichelberg

2026-05-21

17:33 DCMTK Feature #1146: Add character set options to dcm2json

Closed by commit #4f8b940ae. Marco Eichelberg

15:15 DCMTK Bug #1212: NULL dereference in json2dcm

Closed by commit #0748c6e28.
Marco Eichelberg

15:12 DCMTK Bug #1212 (Closed): NULL dereference in json2dcm

@DcmJSONReader::createElement()@ will de-reference a NULL pointer if a call to @DcmItem::newDicomElementWithVR()@ fai... Marco Eichelberg

14:44 DCMTK Bug #1211 (Closed): Heap-buffer-overflow in I2DBmpSource::parse24_32BppRow()

Closed by commit #68b57d3cf. Marco Eichelberg

14:37 DCMTK Bug #1211 (Closed): Heap-buffer-overflow in I2DBmpSource::parse24_32BppRow()

An invalid BMP file with 16, 24 or 32 bit per pixel that contains a color palette (which is not permitted for these i... Marco Eichelberg

2026-05-12

15:12 DCMTK Feature #1202 (Closed): Remove C++98 support and enable STL by default

Closed by commit #7354a5bdf.
Marco Eichelberg

2026-05-06

19:34 DCMTK Bug #1206: Remote Heap Buffer Overflow in dcmqrscp

This issue was apparently logged twice. See issue 1199: http://support.dcmtk.org/redmine/issues/1199 Marco Eichelberg

19:34 DCMTK Bug #1199 (Closed): Security Vulnerability Report: Remote Heap Buffer Overflow in dcmqrscp (deleteOldestImages)

This issue was apparently logged twice. See issue 1206: http://support.dcmtk.org/redmine/issues/1206 Marco Eichelberg

2026-05-04

17:49 DCMTK Bug #1206 (Closed): Remote Heap Buffer Overflow in dcmqrscp

Marco Eichelberg

17:48 DCMTK Bug #1206: Remote Heap Buffer Overflow in dcmqrscp

Closed by commit #0f78a4ef6.
Marco Eichelberg

17:46 DCMTK Bug #1206 (Closed): Remote Heap Buffer Overflow in dcmqrscp

In the function @deleteOldestImages()@ , an array named @StudyArray@ is allocated on the heap with a fixed size of @M... Marco Eichelberg