Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-44033: DCMTK XML parser may crash with deeply nested files

CVE-2026-44033 · published 27 days ago

Summary

The OFFIS DCMTK version 3.7.0 XML parser can run out of memory and stop working when it processes an XML file that contains many nested elements. This can cause the application that uses the parser, such as dcmencap, to stop responding or crash. Upgrade DCMTK to a version that includes the fix or avoid processing untrusted XML files.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	offis	dcmtk	3.7.0
Debian:12	debian	dcmtk	All versions
Ubuntu:Pro:16.04:LTS	canonical	dcmtk	All versions

Original advisory text

Uncontrolled recursion in the DCMTK bundled XML parser allows denial of service

Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::emptyTheNode() in the bundled XML parser (ofstd/libsrc/ofxml.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML document with deeply nested elements. The parser is reachable through dcmencap when encapsulating a CDA document, and through any application that calls OFXMLParser::parseFile() or OFXMLParser::parseString() on untrusted input. The issue is fixed in commit d12e350e687530eb41e2b0c860aff4d8c04e5941.

References

https://github.com/DCMTK/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941 Third Party Advisory
https://support.dcmtk.org/redmine/issues/1214 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-44033 Vendor Advisory
https://ubuntu.com/security/CVE-2026-44033 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-44033 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.3 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-674Uncontrolled Recursion

Timeline

Published8 Oct 2026

Updated21 Oct 2026

First seen8 Oct 2026

Sources

CVE-2026-44033 · NVD

CVE-2026-44033 · MITRE

DEBIAN-CVE-2026-44033 · OSV

UBUNTU-CVE-2026-44033 · OSV

CVE-2026-44033 · OSV

Track software like this

Free during beta