CVE-2026-12805

A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected element is the function XMLNode::parseFile in the library ofstd/libsrc/ofxml.cc. Executing a manipulation can lead to heap-based buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. This patch is called 1d4b3815c0987840a983160bfc671fef63a3105b. It is best practice to apply a patch to resolve this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

• CWE-119
• CWE-122

• https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=1d4b3815c0987840a983160bfc671fef63a3105b
• https://github.com/DCMTK/dcmtk/commit/1d4b3815c0987840a983160bfc671fef63a3105b
• https://medium.com/@faboherrera.fabo/dcmtk-vulnerability-report-201afc687790
• https://support.dcmtk.org/redmine/issues/1208
• https://vuldb.com/cve/CVE-2026-12805
• https://vuldb.com/submit/836273
• https://vuldb.com/vuln/372599
• https://vuldb.com/vuln/372599/cti

Published

Jun 21, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1280The Frontend File Manager Plugin for WordPress is vulnerable…7.5
• CVE-2026-12800The Premium Packages – Sell Digital Products Securely plugin…7.5
• CVE-2026-12801The Ultra Addons for Contact Form 7 plugin for WordPress is …6.4
• CVE-2026-12802In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData…7.5
• CVE-2026-12803In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC d…7.5
• CVE-2026-12804A vulnerability was detected in lemonldap-ng up to 2.23.0. I…4.3
• CVE-2026-12806A vulnerability has been found in Edimax BR-6478AC V2 1.23. …8.8
• CVE-2026-12807A vulnerability was found in Edimax BR-6478AC V2 1.23. This …6.3
• CVE-2026-12808A vulnerability was determined in Edimax BR-6478AC V2 1.23. …6.3
• CVE-2026-12809A vulnerability was identified in Edimax BR-6478AC V2 1.23. …6.3
• CVE-2026-1281A code injection in Ivanti Endpoint Manager Mobile allowing …9.8
• CVE-2026-12810A security flaw has been discovered in Edimax BR-6478AC V2 1…6.3