CVE-2026-44034

A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() in dcmdata/libsrc/dcrleccd.cc of OFFIS DCMTK 3.7.0 allows an attacker to read up to 63 bytes of adjacent heap memory, or cause a crash, via a crafted RLE Lossless DICOM file whose pixel data fragment is shorter than the 64-byte RLE header. The function copies 64 bytes without checking the fragment length, a check that the sibling function decode() already performs. Applications that decode RLE images frame by frame (for example, through DcmPixelData::getUncompressedFrame()) are affected. The dcmdrle command-line tool uses decode() and is not affected. The issue is fixed in commit 45469f3c30037e9c7159290e4bb74cd7b3b9ef1d.

• CWE-125

• https://github.com/DCMTK/dcmtk/commit/45469f3c30037e9c7159290e4bb74cd7b3b9ef1d
• https://support.dcmtk.org/redmine/issues/1213

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44024Fluentd collects events from various data sources and writes…9.8
• CVE-2026-44025Fluentd collects events from various data sources and writes…7.5
• CVE-2026-44028An issue was discovered in Nix before 2.34.7 and Lix before …7.5
• CVE-2026-44029An issue was discovered in Nix before 2.34.7. Writing to arb…5.3
• CVE-2026-44031Uncontrolled recursion in DcmSequenceOfItems::read() and Dcm…7.5
• CVE-2026-44033Uncontrolled recursion in XMLNode::ParseXMLElement() and XML…5.5
• CVE-2026-44035Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in…5.5
• CVE-2026-44036Uncontrolled mutual recursion between DcmXMLParseHelper::par…5.5
• CVE-2026-44037Uncontrolled mutual recursion between DcmJSONReader::parseDa…5.5
• CVE-2026-44038A global out-of-bounds read in the Huffman decoder of the bu…4.4
• CVE-2026-4404Use of hard coded credentials in GoHarbor Harbor version 2.1…9.4
• CVE-2026-44040UltraVNC through 1.8.2.2 uses a cryptographically weak pseud…6.5