CVE-2026-44036
Description
A flaw was found in DCMTK's XML-to-DICOM converter. An attacker can exploit this vulnerability by supplying a crafted XML file containing deeply nested elements. When parsed, this input triggers uncontrolled recursion that exhausts stack memory and crashes the application, resulting in a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate because triggering the flaw requires local user interaction or an automated pipeline to ingest untrusted XML content, and the resulting failure is confined to a process crash. Typical Red Hat deployments do not expose DICOM conversion utilities directly to untrusted network traffic, limiting exposure to scenarios where malicious input is explicitly processed. Furthermore, the vulnerability does not compromise system integrity or disclose confidential information, restricting the blast radius strictly to application availability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
