CVE-2026-44033
Description
A flaw was found in dcmtk. An attacker can trigger uncontrolled recursion by tricking a user or application into parsing a specially crafted XML document containing deeply nested elements. This flaw leads to stack exhaustion, causing the application to crash and resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate severity because exploitation requires an attacker to convince a user or automated process to handle a specially crafted XML file, resulting only in a denial of service without compromising data confidentiality or system integrity. In Red Hat environments, DCMTK is not included in supported Red Hat Enterprise Linux releases and is only available through community repositories such as EPEL. Furthermore, exposure is limited to environments where DICOM applications or utilities explicitly process untrusted external XML documents.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
