Vulnerability · Published May 31, 2026 · Assigned by VulDB
CVE-2026-10194OFFIS DCMTK dcmqrscp dcmqrdbi.cc deleteOldestImages heap-based overflow
Medium 6.3
In plain English
A medium-severity heap buffer overflow in DCMTK from OFFIS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A weakness has been identified in OFFIS DCMTK 3.7.0. This affects the function DcmQueryRetrieveIndexDatabaseHandle::deleteOldestImages of the file dcmqrdb/libsrc/dcmqrdbi.cc of the component dcmqrscp. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. This patch is called 0f78a4ef6f645ea5530166e445e5436a5de58e75. A patch should be applied to remediate this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | dcmtk | 3.6.7-9~deb12u4 | DEBIAN-CVE-2026-10194 |
| Debian:13 | dcmtk | 3.6.9-5+deb13u1 | DEBIAN-CVE-2026-10194 |
| Debian:14 | dcmtk | 3.7.0+really3.7.0-5 | DEBIAN-CVE-2026-10194 |
| Ubuntu:25.10 | dcmtk | no fix listed | UBUNTU-CVE-2026-10194 |
| Ubuntu:26.04:LTS | dcmtk | no fix listed | UBUNTU-CVE-2026-10194 |
| Ubuntu:26.10 | dcmtk | no fix listed | UBUNTU-CVE-2026-10194 |
Affected products (as reported)
Weakness: CWE-122, CWE-119 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
References
- VDB-367475 | OFFIS DCMTK dcmqrscp dcmqrdbi.cc deleteOldestImages heap-based overflow vdb-entry, technical-description
- VDB-367475 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
- CVE-2026-10194 | CVE Analysis and Report third-party-advisory
- Submit #821029 | DCMTK v3.7.0+ DEV Heap-based Buffer Overflow third-party-advisory
- https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=0f78a4ef6f645ea5530166e445e5436a5de58e75 broken-link, patch