Description
An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.
Published: 2026-06-30
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a type‑confusion flaw that allows an unauthenticated attacker to send a single crafted query to the worklist server, causing it to crash. This crash results in a loss of service availability for the affected system. The flaw does not directly compromise confidentiality or integrity but the resulting denial of service can be disruptive to medical and clinical operations.

Affected Systems

Vulnerable product: OFFIS DICOM:DCMTK Toolkit. Specific versions are not disclosed, so any build of the toolkit that includes the worklist server component may be at risk.

Risk and Exploitability

The CVSS score of 8.7 indicates a high‑severity denial‑of‑service vulnerability. The EPSS score is not available and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is network‑based: an unauthenticated attacker can trigger the crash by connecting to the worklist server and sending the crafted query. No special privileges or additional conditions are required beyond the presence of a valid Called AE Title, a storage directory, a lockfile, and at least one matching worklist record.

Generated by OpenCVE AI on June 30, 2026 at 22:51 UTC.

Remediation

Vendor Solution

The maintainer was notified of these vulnerabilities and has provided a fix. The fix is included in the latest commits and can be obtained in the following snapshot: https://github.com/DCMTK/dcmtk/releases/tag/latest

OpenCVE Recommended Actions

  • Apply the latest DCMTK release from GitHub, which fixes the type‑confusion (CWE‑843) flaw in the worklist server.
  • If an immediate update is not possible, add validation logic to ensure that input queries match the expected data types, mitigating the type‑confusion vulnerability (CWE‑843) until the vendor patch is applied.
  • Limit the worklist server’s exposure by configuring firewall rules to allow traffic only from trusted hosts, reducing the risk of an unauthenticated attacker reaching the vulnerable component.
  • If the worklist service is not essential for your operations, disable or remove it to eliminate the attack surface.

Generated by OpenCVE AI on June 30, 2026 at 22:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 01 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 01 Jul 2026 10:30:00 +0000

Type Values Removed Values Added
First Time appeared Offis Dicom
Offis Dicom dcmtk Toolkit
Vendors & Products Offis Dicom
Offis Dicom dcmtk Toolkit

Tue, 30 Jun 2026 21:00:00 +0000

Type Values Removed Values Added
Description An unauthenticated attacker can crash the worklist server with a single crafted query when the server has a valid Called AE Title / storage directory, the expected lockfile, and at least one matching worklist record.
Title OFFIS DCMTK Toolkit Type Confusion
Weaknesses CWE-843
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Offis Dicom Dcmtk Toolkit
cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2026-07-01T15:41:57.859Z

Reserved: 2026-06-22T17:03:25.982Z

Link: CVE-2026-44628

cve-icon Vulnrichment

Updated: 2026-07-01T15:41:53.211Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-01T10:01:04Z

Weaknesses
  • CWE-843

    Access of Resource Using Incompatible Type ('Type Confusion')