CVE catalog

CVE-2026-97059

Severity: High · CVSS 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Sep 24, 2026, 1:52:00 PM UTC
Updated: Sep 24, 2026, 2:18:21 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.34% · Oct 25, 2026

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	dcmtk	sid	`3.7.0+really3.7.0-7`	vulnerable
Debian	dcmtk	forky	`3.7.0+really3.7.0-7`	vulnerable
Debian	dcmtk	trixie	`3.6.9-5+deb13u3`	vulnerable
Debian	dcmtk	bookworm	`3.6.7-9~deb12u4`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	dcmtk	source	sid	`(unfixed)`	not yet assigned	Not reported	[1149131]
Debian	dcmtk	source	forky	`(unfixed)`	not yet assigned	Not reported	[1149131]
Debian	dcmtk	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1149131]
Debian	dcmtk	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1149131]

[Debian bug #1149131]

Notes

[trixie] dcmtk: Minor issue [bookworm] dcmtk: Minor issue; ConcatenationLoader API, not used by any DCMTK tool

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[dcmtk]Affected
Details (2)
- 3.6.7-9~deb12u4 · amd64 · bookworm
  Affected
  nvd · dcmtk · debian · bookworm; nvd · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · arm64 · bookworm
  Affected
  nvd · dcmtk · debian · bookworm; nvd · dcmtk · debian · 12
[dcmtk-doc]Affected
Source package: [dcmtk]
Details (2)
- 3.6.7-9~deb12u4 · all · bookworm
  Affected
  nvd · dcmtk · debian · bookworm; nvd · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · all · bookworm
  Affected
  nvd · dcmtk · debian · bookworm; nvd · dcmtk · debian · 12
[libdcmtk17]Affected
Source package: [dcmtk]
Details (2)
- 3.6.7-9~deb12u4 · amd64 · bookworm
  Affected
  nvd · dcmtk · debian · bookworm; nvd · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · arm64 · bookworm
  Affected
  nvd · dcmtk · debian · bookworm; nvd · dcmtk · debian · 12
[libdcmtk-dev]Affected
Source package: [dcmtk]
Details (2)
- 3.6.7-9~deb12u4 · amd64 · bookworm
  Affected
  nvd · dcmtk · debian · bookworm; nvd · dcmtk · debian · 12
- 3.6.7-9~deb12u4 · arm64 · bookworm
  Affected
  nvd · dcmtk · debian · bookworm; nvd · dcmtk · debian · 12

[Debian 13 (Trixie)]

[dcmtk]Affected
Details (2)
- 3.6.9-5+deb13u2 · amd64 · trixie
  Affected
  nvd · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · arm64 · trixie
  Affected
  nvd · dcmtk · debian · 13
[dcmtk-data]Affected
Source package: [dcmtk]
Details (2)
- 3.6.9-5+deb13u2 · all · trixie
  Affected
  nvd · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · all · trixie
  Affected
  nvd · dcmtk · debian · 13
[dcmtk-doc]Affected
Source package: [dcmtk]
Details (2)
- 3.6.9-5+deb13u2 · all · trixie
  Affected
  nvd · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · all · trixie
  Affected
  nvd · dcmtk · debian · 13
[libdcmtk19]Affected
Source package: [dcmtk]
Details (2)
- 3.6.9-5+deb13u2 · amd64 · trixie
  Affected
  nvd · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · arm64 · trixie
  Affected
  nvd · dcmtk · debian · 13
[libdcmtk-dev]Affected
Source package: [dcmtk]
Details (2)
- 3.6.9-5+deb13u2 · amd64 · trixie
  Affected
  nvd · dcmtk · debian · 13
- 3.6.9-5+deb13u2 · arm64 · trixie
  Affected
  nvd · dcmtk · debian · 13

Observed: Oct 23, 2026, 8:35:52 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]