CVE-2026-50254
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to write files, access unauthorized information, exhaust memory, or crash affected DCMTK client or server processes. The following versions of OFFIS DCMTK Toolkit are affected: DCMTK <=3.7.0 (CVE-2026-50003, CVE-2026-50254, CVE-2026-35505, CVE-2026-52868, CVE-2026-44628) CVSS Vendor Equipment Vulnerabilities v3 9.8 OFFIS OFFIS DCMTK Toolkit Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Release of Memory after Effective Lifetime, Access of Resource Using Incompatible Type ('Type Confusion') Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: Germany Vulnerabilities Expand All + CVE-2026-50003 A malicious or compromised server can make a DCMTK client using bit-preserving C-GET storage mode write files outside the chosen output directory, using both relative (../) paths and absolute paths. View CVE Details Affected Products OFFIS DCMTK Toolkit Vendor: OFFIS Product Version: OFFIS DCMTK: <=3.7.0 Product Status: known_affected Remediations Mitigation The maintainer was notified of these vulnerabilities and has provided a fix. The fix is included in the latest commits and can be obtained in the following snapshot: Vendor fix https://github.com/DCMTK/dcmtk/releases/tag/latest. https://github.com/DCMTK/dcmtk/releases/tag/latest Mitigation Users are recommended to download the latest GitHub release once it becomes available. Relevant CWE: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Metrics CVSS Version Base Score Base Severity Vector String 3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVE-2026-50254 An unauthenticated remote attacker can repeatedly send a single crafted connection request to leak memory. Against storescp
CSIRTS triage
- What
- The vulnerabilities could allow an attacker to write files, access unauthorized information, exhaust memory, or crash processes.
- Who is affected
- Deployments of DCMTK Toolkit versions 3.7.0 and earlier.
- Urgency
- Remediation is critical due to the high severity of the vulnerabilities (CVSS 9.8).
- Action
- Update to a patched version of DCMTK Toolkit.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-50254
Get an email if CVE-2026-50254 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.38% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 30% of all EPSS-scored CVEs.
Advisory coverage (2)
- highCVE-2026-50254: An unauthenticated remote attacker can repeatedly send a single crafted connection request to …nvd · 2026-06-30
- criticalOFFIS DCMTK Toolkitcisa · 2026-06-30
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-50254)