Loading vulnerability…
VR-spoofing type confusion in OFFIS DCMTK wlmscpfs
CVE-2026-44628 is a remotely exploitable type confusion vulnerability in the OFFIS DCMTK Toolkit worklist server component, wlmscpfs, affecting versions prior to 3.7.0. An unauthenticated client can negotiate Explicit VR and send a crafted DICOM C-FIND request in which a dictionary-defined sequence tag is encoded on the wire using a non-sequence VR. In the vulnerable code path, wlmscpfs uses the resulting object as though it were a DcmSequenceOfItems without verifying the actual runtime type, causing access of a resource using an incompatible type. Under the documented conditions, this wrong-type cast/use crashes the process. The issue is triggered during worklist query handling and results in denial of service rather than reported code execution or data disclosure.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an unauthenticated remote attacker to crash the wlmscpfs worklist server with a single crafted query, causing denial of service. In single-process mode, the service can stop entirely until restarted. In the default forked/multi-process behavior described in the source material, only the child handling the malicious request crashes while the parent continues serving subsequent requests, reducing but not eliminating operational impact.
If you can’t patch tonight, do this now.
Until patched, restrict DICOM worklist services to trusted networks and minimize exposure to untrusted clients. Prefer multi-process or fork mode where available to reduce full-service outage risk from a child-process crash. Additional defensive measures mentioned in the source material include validating incoming query parameters, ensuring proper lockfile handling, and implementing robust error handling around malformed requests.
Patch, then assume compromise.
Apply the vendor/upstream fix for CVE-2026-44628. The provided context states that fixes were committed upstream in OFFIS DCMTK master branch in commits f4e007468 and 694a0a06a, but were not yet included in a release at the time of the referenced advisory. Upgrade to a fixed release once available, or backport/apply the upstream patches if operationally feasible.
No public exploits tracked yet. Mallory keeps watching.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.