DCMTK

Today

10:29 Bug #1082 (Closed): Possible memory leak in DcmDataset copy constructor

Marco Eichelberg

2026-06-17

18:20 Bug #1221: Out-of-bounds read in bundled IJG JPEG Huffman decoder

This issue was also reported on 2026-05-19 by Arjun Basnet, Senior Security Researcher, Securin. It has been register... Marco Eichelberg

17:53 Bug #1226: Unbound recursion in DSRDocumentTreeNode::readXML()

Closed by commit #9057782f9.
Marco Eichelberg

17:51 Bug #1226 (New): Unbound recursion in DSRDocumentTreeNode::readXML()

Currently, the XML to DICOM SR parser relies on a depth gate in libxml2 to prevent unbound recursion when reading a m... Marco Eichelberg

17:46 Bug #1224 (Closed): xml2dcm parseDataSet / parseSequence mutual recursion

Marco Eichelberg

16:52 Bug #1225 (Closed): json2dcm readValue JSON SQ unbounded recursion

Closed by commit #cf955e64c. Marco Eichelberg

2026-06-16

18:25 Bug #1225: json2dcm readValue JSON SQ unbounded recursion

Reported 2026-05-19 by Arjun Basnet, Senior Security Researcher, Securin. Marco Eichelberg

18:24 Bug #1225: json2dcm readValue JSON SQ unbounded recursion

This issue has been registered as CVE-2026-44037. Marco Eichelberg

18:24 Bug #1225 (Closed): json2dcm readValue JSON SQ unbounded recursion

@DcmJsonReaderBase::readValue()@ recurses via @DcmJsonReaderBase::parseSequence()@ on SQ JSON value items with no dep... Marco Eichelberg

18:15 Bug #1224: xml2dcm parseDataSet / parseSequence mutual recursion

Closed by commit #87f256d73.
Marco Eichelberg

18:12 Bug #1224 (Closed): xml2dcm parseDataSet / parseSequence mutual recursion

@DcmXMLParseHelper::parseDataSet()@ at xml2dcm.cc:618 calls @parseSequence()@ for every @<sequence>@ element. @parseS... Marco Eichelberg

2026-06-12

11:59 Bug #1221 (Closed): Out-of-bounds read in bundled IJG JPEG Huffman decoder

Michael Onken

11:59 Bug #1222 (Closed): Out-of-bounds read in CharLS JPEG-LS EndScan()

Michael Onken

11:59 Bug #1223 (Closed): Out-of-bounds read in CharLS JPEG-LS QuantizeGratient()

Michael Onken

2026-06-11

07:40 Bug #1223: Out-of-bounds read in CharLS JPEG-LS QuantizeGratient()

Fixed with commit b6691c7a0fdfd261c20c2509c2ac16966bd37763 Michael Onken

07:40 Bug #1222: Out-of-bounds read in CharLS JPEG-LS EndScan()

Fixed with commit b818c19720bd3c5c273f7c0578fef3990333af22 Michael Onken

07:39 Bug #1221: Out-of-bounds read in bundled IJG JPEG Huffman decoder

Fixed with commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5. Michael Onken

2026-06-10

11:16 Bug #1223 (Closed): Out-of-bounds read in CharLS JPEG-LS QuantizeGratient()

DCMTK's bundled CharLS JPEG-LS library (dcmjpls/libcharls) performs an out-of-bounds heap read in its near-lossless d... Michael Onken

11:15 Bug #1222 (Closed): Out-of-bounds read in CharLS JPEG-LS EndScan()

DCMTK's bundled CharLS JPEG-LS library (dcmjpls/libcharls) performs an out-of-bounds heap read when finishing decode ... Michael Onken

11:13 Bug #1221 (Closed): Out-of-bounds read in bundled IJG JPEG Huffman decoder

DCMTK's bundled IJG JPEG library (dcmjpeg/libijg8, and the identical libijg12/libijg16 copies) contains a Huffman-tab... Michael Onken

2026-06-05

18:32 Bug #1205 (Closed): Building of a single shared library fails

Closed by commit #37bbe0f81. Marco Eichelberg

11:08 Feature #1220 (New): Use of DcmDate/Time/DateTime instead of OFDate/Time/DateTime

In various places in DCMTK the classes OFDate/Time/DateTime are used to retrieve the current data or time in DICOM fo... Marco Eichelberg

2026-05-31

11:28 Bug #1219 (Closed): Inconsistent handling of uncompressed icon images

Closed by commit #d526cbb08.
Marco Eichelberg

08:28 Bug #1219 (Closed): Inconsistent handling of uncompressed icon images

When loading a compressed DICOM image file that contains an Icon Image Sequence with uncompressed pixel data (which i... Marco Eichelberg

2026-05-29

18:06 Bug #1217 (Closed): AE_6/AE_3 error-return paths skip heap cleanup

Michael Onken

18:06 Bug #1217: AE_6/AE_3 error-return paths skip heap cleanup

A second leak was discovered during fixing the orginally reported one.
translatePresentationContextList() also now... Michael Onken

14:40 Bug #1218: wlmscpfs unchecked DcmElement* to DcmSequenceOfItems* cast

Bug reported by Abhinav Agarwal. Michael Onken

14:31 Bug #1218 (Closed): wlmscpfs unchecked DcmElement* to DcmSequenceOfItems* cast

Michael Onken

14:29 Bug #1218: wlmscpfs unchecked DcmElement* to DcmSequenceOfItems* cast

Fixed in commit f4e007468. Michael Onken

14:25 Bug #1216 (Closed): destroyUserInformationLists() leaks ExtNeg sub-items

Fixed with commit 23f181. Michael Onken

2026-05-27

09:34 Bug #1218 (Closed): wlmscpfs unchecked DcmElement* to DcmSequenceOfItems* cast

Root cause: wldsfs.cc has 3 functions with unchecked C-style casts of findAndGetElement() results to DcmSequenceOfIte... Michael Onken

09:33 Bug #1217 (Closed): AE_6/AE_3 error-return paths skip heap cleanup

Bug as reported by Abhinav Agarwal:
Root cause: AE_6_ExamineAssociateRequest (dulfsm.cc:1231): after parseAssociat... Michael Onken

09:32 Bug #1216 (Closed): destroyUserInformationLists() leaks ExtNeg sub-items

Bug as reported by Abhinav Agarwal:
Root cause: helpers.cc:67 does `delete userInfo->extNegList` which frees the O... Michael Onken

2026-05-26

09:38 Bug #1209 (Closed): Low severity short read in DcmMetaInfo::nextTagIsMeta()

Jörg Riesmeier

09:38 Bug #1209: Low severity short read in DcmMetaInfo::nextTagIsMeta()

Fixed with commit e267be7ff. Jörg Riesmeier

2026-05-25

12:21 Bug #1212 (Closed): NULL dereference in json2dcm

Marco Eichelberg

12:02 Bug #1213: RLE decodeFrame() Heap-OOB Read

This issue has been registered as CVE-2026-44034. Marco Eichelberg

12:01 Bug #1214: Unbounded recursion in XMLParser library

This issue has been registered as CVE-2026-44033. Marco Eichelberg

12:01 Bug #1191: Stack Overflow via Deeply Nested DICOM Sequences

This issue has been registered as CVE-2026-44031. Marco Eichelberg

12:00 Bug #1194: OS command injection vulnerability in storescp --exec-on-reception

This issue has been registered as CVE-2026-44030. Marco Eichelberg

11:56 Bug #1215 (Closed): Unbounded recursion in DcmDicomDir::moveRecordToTree()

Fixed by commit #ca761f7f3.
This issue has been registered as CVE-2026-44035. Marco Eichelberg