OFFIS DCMTK Toolkit

# Critical Path Traversal and Memory Leaks Discovered in DCMTK Medical Imaging Toolkit

## The Threat

The OFFIS DCMTK (DICOM Toolkit), a widely deployed open-source library for handling DICOM medical imaging data, contains five critical vulnerabilities that could allow remote attackers to write arbitrary files, crash services, or trigger denial-of-service conditions. The toolkit is used across healthcare organizations globally to process, transmit, and store medical imaging data—making these flaws a significant concern for hospital infrastructure and patient data security.

The most severe vulnerability, CVE-2026-50003, is a path traversal flaw that allows a malicious or compromised DICOM server to trick a DCMTK client into writing files outside its intended output directory. By exploiting bit-preserving C-GET storage mode, an attacker can use both relative paths (like ../) and absolute file paths to place arbitrary content anywhere the client process has write permissions. This attack requires no authentication and no user interaction, meaning a misconfigured server or man-in-the-middle attacker could silently redirect sensitive data or plant malicious files within trusted medical systems.

Two additional vulnerabilities (CVE-2026-50254 and CVE-2026-35505) involve memory leaks in the DCMTK server component that can be triggered by unauthenticated remote attackers. By sending specially crafted connection requests, an attacker can force memory exhaustion, causing the server process to terminate and stop accepting connections until manual restart. In healthcare environments operating on tight schedules and limited IT staff, such outages can cascade into critical workflow disruptions and patient care delays. These vulnerabilities underscore how infrastructure flaws—even in specialized medical data tools—can ripple outward to affect clinical operations.

## Severity and Impact

| Aspect | Details |

|--------|---------|

| Primary CVE | CVE-2026-50003 (Path Traversal) |

| Secondary CVEs | CVE-2026-50254, CVE-2026-35505, CVE-2026-52868, CVE-2026-44628 |

| Highest CVSS v3.1 | 9.8 CRITICAL |

| CVSS v4.0 | 9.3 CRITICAL |

| Vector String | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |

| Attack Complexity | Low – No special conditions required |

| Authentication Required | None – Unauthenticated remote exploit |

| Attack Vector | Network – Exploitable over the internet |

| Related CWEs | CWE-22 (Path Traversal), CWE-401 (Memory Leak), CWE-416 (Type Confusion) |

| Affected Sectors | Healthcare and Public Health (Critical Infrastructure) |

| Global Reach | Worldwide deployment |

## Affected Products

OFFIS DCMTK Toolkit version 3.7.0 and earlier

The vulnerability affects all installations running DCMTK 3.7.0 or prior versions. This includes:

Healthcare organizations should audit their DICOM infrastructure to identify DCMTK usage—it may be embedded in archival systems, PACS (Picture Archiving and Communication System) components, or integration middleware not immediately obvious in asset inventories.

## Mitigations

Immediate Actions:

Interim Mitigations (if immediate patching is not possible):

Long-term Hardening:

## References

---

## HackWire Analysis

These vulnerabilities expose a critical gap in medical infrastructure security: the assumption that specialized, niche tools like DCMTK operate in "trusted" environments where authentication is optional and input validation is secondary. The healthcare sector has historically prioritized availability and compatibility over stringent security controls, and DCMTK's deployment patterns reflect that legacy mindset.

The path traversal flaw is particularly insidious because it exploits the C-GET protocol feature designed for legitimate clinical workflows—a malicious server doesn't need to break anything, it just needs to redirect where files are written. In distributed healthcare networks where imaging data flows between hospital departments, imaging centers, and cloud archives, a compromised server (or attacker with network access) can silently inject data into clinical systems without raising alarms. The memory leak vulnerabilities follow a similar pattern: they're not complex exploits, but they work because DCMTK assumes its network peers are benign.

This cascades into a visibility problem. Many healthcare organizations don't have a clear inventory of where DCMTK is deployed. It's embedded in commercial PACS systems, open-source imaging suites, and legacy archive software built 10+ years ago. Patch velocity in healthcare is notoriously slow—hospitals can take 6-12 months to roll out non-critical updates across imaging systems that can't be taken offline during patient care. The combination of embedded dependencies, slow update cycles, and internet-facing DICOM infrastructure creates a persistent window where many institutions remain vulnerable long after the fix is available.

Organizations should treat this as an audit opportunity: the path traversal flaw is a reminder that even specialized medical tools need defense-in-depth. Network segmentation is the most effective interim control—most healthcare systems don't need DICOM traffic crossing the internet. If your imaging servers talk to external systems or untrusted networks, this vulnerability moves from "patch eventually" to "patch this week." For critical infrastructure responsible for patient data and clinical operations, that distinction matters.

— HackWire Editorial

## Related Coverage