CVE-2026-44036

Published 8 October 2026 · tracked since 9 October 2026

Description

Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() in the XML-to-DICOM converter (dcmdata/libdcxml/xml2dcm.cc) of OFFIS DCMTK 3.7.0 allows an attacker to cause a denial of service (stack exhaustion and process crash) via a crafted XML file

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-14990 CRITICAL 9.3
• CVE-2026-107613 MEDIUM 5.9
• CVE-2026-107614 MEDIUM 6.1
• CVE-2026-107615 HIGH 7.8
• CVE-2026-107611 HIGH 7.1
• CVE-2026-107612 HIGH 7.8
• CVE-2026-103663
• CVE-2026-62127 MEDIUM 6.5
• CVE-2026-44033 MEDIUM 5.5
• CVE-2026-44037 MEDIUM 5.5

→ Open the live CVE board · all tools