CVE-2026-12805
Description
A flaw was found in OFFIS DCMTK. A remote attacker could exploit this vulnerability by manipulating input to the XMLNode::parseFile function. This can lead to a heap-based buffer overflow, a type of memory corruption, which may result in information disclosure or denial of service.
Statement
This Moderate impact vulnerability in OFFIS DCMTK allows a remote attacker to trigger a heap-based buffer overflow by providing specially crafted XML input to the XMLNode::parseFile function. Successful exploitation could lead to information disclosure or denial of service. The public availability of exploit details increases the risk.
Mitigation
Users should avoid processing untrusted or unverified XML files with applications that rely on the OFFIS DCMTK library. Implementing strict input validation and restricting the sources of XML data can reduce the exposure to this vulnerability.
Understanding the Weakness (CWE)
Integrity,Availability,Confidentiality
Technical Impact: DoS: Crash, Exit, or Restart; Execute Unauthorized Code or Commands; Read Memory; Modify Memory
If the incorrect calculation is used in the context of memory allocation, then the software may create a buffer that is smaller or larger than expected. If the allocated buffer is smaller than expected, this could lead to an out-of-bounds read or write (CWE-119), possibly causing a crash, allowing arbitrary code execution, or exposing sensitive data.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
