Multiple Critical OFFIS DCMTK Flaws Enable File Write, Data Exposure, and DoS

Several high-severity vulnerabilities have been disclosed in the OFFIS DCMTK Toolkit, a widely used DICOM implementation for medical imaging workflows, including a critical path traversal flaw tracked as CVE-2026-50003. That issue allows a malicious or compromised server to make a DCMTK client using bit-preserving C-GET storage mode write files outside the intended output directory via relative ../ or absolute paths. Another path traversal bug, CVE-2026-52868, lets an unauthenticated remote attacker read worklist records from directories outside the intended per-AE worklist storage area, potentially exposing sensitive patient or departmental data across organizational boundaries in multi-area deployments.

Additional remotely exploitable flaws can also disrupt DCMTK services. CVE-2026-50254 and CVE-2026-35505 are memory-leak issues that allow repeated crafted connection requests to exhaust memory and crash single-process deployments such as storescp, while CVE-2026-44628 is a type confusion vulnerability that can crash the worklist server with a single crafted query under specific conditions. Reported severity ranges up to CVSS 9.8 under v3.1 and 9.3 under v4.0, and recommended mitigations include updating DCMTK, validating and sanitizing file paths and inputs, restricting worklist storage access, using stronger access controls, and considering multi-process operation to reduce denial-of-service impact.