CVE-2026-44038

A global out-of-bounds read in the Huffman decoder of the bundled IJG JPEG libraries (dcmjpeg/libijg8, libijg12 and libijg16) of OFFIS DCMTK 3.7.0 allows an attacker to read memory beyond the extend_test[] and extend_offset[] tables, causing incorrectly decoded pixel data or a crash, via a DICOM file with a crafted JPEG stream whose Huffman table defines a difference category above 15. Huffman symbol values are not range-checked unless DCMTK is built with DCMTK_ENABLE_STRICT_HUFFMAN_TABLE_CHECK, which is disabled by default. dcmdjpeg and any application that decompresses JPEG DICOM images with DCMTK are affected. The issue is fixed in commit d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5.

• CWE-125

• https://github.com/DCMTK/dcmtk/commit/d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5
• https://support.dcmtk.org/redmine/issues/1221

Published

Oct 8, 2026

Last Modified

Oct 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44031Uncontrolled recursion in DcmSequenceOfItems::read() and Dcm…7.5
• CVE-2026-44033Uncontrolled recursion in XMLNode::ParseXMLElement() and XML…5.5
• CVE-2026-44034A heap-based out-of-bounds read in DcmRLECodecDecoder::decod…4.4
• CVE-2026-44035Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in…5.5
• CVE-2026-44036Uncontrolled mutual recursion between DcmXMLParseHelper::par…5.5
• CVE-2026-44037Uncontrolled mutual recursion between DcmJSONReader::parseDa…5.5
• CVE-2026-4404Use of hard coded credentials in GoHarbor Harbor version 2.1…9.4
• CVE-2026-44040UltraVNC through 1.8.2.2 uses a cryptographically weak pseud…6.5
• CVE-2026-44041UltraVNC through 1.8.2.2 contains an out-of-bounds read in t…6.5
• CVE-2026-44042UltraVNC repeater through 1.8.2.2 contains an off-by-one err…3.7
• CVE-2026-44046Use of Less Trusted Source vulnerability in Apache APISIX. …5.8
• CVE-2026-44047An SQL injection vulnerability in the MySQL CNID backend in …8.8