DCMTK

2026-05-26

09:38 Bug #1209 (Closed): Low severity short read in DcmMetaInfo::nextTagIsMeta()

Jörg Riesmeier

09:38 Bug #1209: Low severity short read in DcmMetaInfo::nextTagIsMeta()

Fixed with commit e267be7ff. Jörg Riesmeier

2026-05-25

12:21 Bug #1212 (Closed): NULL dereference in json2dcm

Marco Eichelberg

12:15 Bug #1210 (Closed): wlmscpfs Called AE Title used as directory path unsanitized

Marco Eichelberg

12:02 Bug #1213: RLE decodeFrame() Heap-OOB Read

This issue has been registered as CVE-2026-44034. Marco Eichelberg

12:01 Bug #1214: Unbounded recursion in XMLParser library

This issue has been registered as CVE-2026-44033. Marco Eichelberg

12:01 Bug #1191: Stack Overflow via Deeply Nested DICOM Sequences

This issue has been registered as CVE-2026-44031. Marco Eichelberg

12:00 Bug #1194: OS command injection vulnerability in storescp --exec-on-reception

This issue has been registered as CVE-2026-44030. Marco Eichelberg

2026-05-24

19:22 Bug #1214 (Closed): Unbounded recursion in XMLParser library

Closed by commit #d12e350e6.
Marco Eichelberg

19:19 Bug #1214 (Closed): Unbounded recursion in XMLParser library

The methods @XMLNode::ParseXMLElement()@ and @XMLNode::emptyTheNode()@ in @ofstd/libsrc/ofxml.cc@ recurse on the stac... Marco Eichelberg

2026-05-23

18:05 Bug #1213 (Closed): RLE decodeFrame() Heap-OOB Read

Closed by commit #45469f3c3.
Marco Eichelberg

18:02 Bug #1213 (Closed): RLE decodeFrame() Heap-OOB Read

@DcmRLECodecDecoder::decodeFrame()@ (dcmdata/libsrc/dcrleccd.cc:583) calls @memcpy(rleHeader, rleData, 64)@ without v... Marco Eichelberg

2026-05-22

09:30 Feature #1146 (Closed): Add character set options to dcm2json

Marco Eichelberg

2026-05-21

17:33 Feature #1146: Add character set options to dcm2json

Closed by commit #4f8b940ae. Marco Eichelberg

15:15 Bug #1212: NULL dereference in json2dcm

Closed by commit #0748c6e28.
Marco Eichelberg

15:12 Bug #1212 (Closed): NULL dereference in json2dcm

@DcmJSONReader::createElement()@ will de-reference a NULL pointer if a call to @DcmItem::newDicomElementWithVR()@ fai... Marco Eichelberg

14:44 Bug #1211 (Closed): Heap-buffer-overflow in I2DBmpSource::parse24_32BppRow()

Closed by commit #68b57d3cf. Marco Eichelberg

14:37 Bug #1211 (Closed): Heap-buffer-overflow in I2DBmpSource::parse24_32BppRow()

An invalid BMP file with 16, 24 or 32 bit per pixel that contains a color palette (which is not permitted for these i... Marco Eichelberg

2026-05-20

08:18 Bug #1210: wlmscpfs Called AE Title used as directory path unsanitized

Fixed with commit e3878daf870cd2db50eadfde38615f0afae8a584. Michael Onken

08:17 Bug #1210 (Closed): wlmscpfs Called AE Title used as directory path unsanitized

As reported by Abhinav Agarwal:
Root cause: Called AE Title from A-ASSOCIATE-RQ is concatenated directly onto dfPa... Michael Onken