CVE-2026-12805: OFFIS DCMTK Buffer Overflow Vulnerability

CVE-2026-12805 Overview

CVE-2026-12805 is a heap-based buffer overflow [CWE-119] in OFFIS DCMTK versions up to 3.7.0. The flaw resides in the XMLNode::parseFile function within ofstd/libsrc/ofxml.cc. An attacker can trigger the overflow by supplying a malformed XML file to an application that uses the DCMTK library. The exploit has been published, but successful exploitation requires user interaction to process the crafted file. OFFIS responded to the report and released a fixed version. The patch is tracked as commit 1d4b3815c0987840a983160bfc671fef63a3105b.

Critical Impact
Processing a malicious XML file with a vulnerable DCMTK build can corrupt heap memory in XMLNode::parseFile, potentially leading to denial of service or memory corruption in medical imaging workflows that link against the library.

Affected Products

OFFIS DCMTK versions up to and including 3.7.0
Applications statically or dynamically linking the ofstd library
DICOM toolchains relying on XMLNode::parseFile for XML parsing

Discovery Timeline

2026-06-21 - CVE-2026-12805 published to NVD
2026-06-23 - Last updated in NVD database

Technical Details for CVE-2026-12805

Vulnerability Analysis

The defect is a heap-based buffer overflow inside XMLNode::parseFile, the XML loader exposed by the ofstd utility library of DCMTK. DCMTK is a widely deployed open-source DICOM toolkit used by medical imaging vendors, research projects, and PACS integrations. The function reads an XML document from disk and constructs an in-memory tree representation. During parsing, an out-of-bounds write occurs on a heap-allocated buffer when specific input conditions are met. Because DCMTK is consumed as a library, any downstream application that calls XMLNode::parseFile on untrusted input inherits the flaw.

Root Cause

The vulnerable code path in ofstd/libsrc/ofxml.cc does not enforce adequate bounds when copying or expanding parsed XML content into a heap buffer. This is a classic [CWE-119] improper restriction of operations within the bounds of a memory buffer. The maintainer fix updates the parser logic; the commit also rolls the OFFIS copyright header to 2026, indicating the change is part of the active release branch.

Attack Vector

An attacker delivers a crafted XML file to a system running a DCMTK-linked application. The flaw is reachable from the network in deployments where DCMTK ingests XML from remote sources, but it requires the user, or an automated workflow, to invoke parsing on the malicious file. Public proof-of-concept material is referenced through the VulDB CVE-2026-12805 Record and the Medium DCMTK Vulnerability Report.

text

 /*
  *
- *  Copyright (C) 2011-2025, OFFIS e.V.
+ *  Copyright (C) 2011-2026, OFFIS e.V.
  *  All rights reserved.  See COPYRIGHT file for details.
  *
  *  This software and supporting documentation were slightly modified by

Source: GitHub DCMTK Commit Log — the upstream patch hardens XMLNode::parseFile against the overflow condition.

Detection Methods for CVE-2026-12805

Indicators of Compromise

Unexpected crashes or segmentation faults in processes that load ofstd and invoke XMLNode::parseFile.
Presence of untrusted or anomalously sized XML files in DICOM ingest directories.
Heap corruption signatures in core dumps from dcmtk command-line tools such as dcm2xml, xml2dcm, or vendor binaries that embed the library.

Detection Strategies

Inventory binaries linking against DCMTK 3.7.0 or earlier and flag them for review.
Run AddressSanitizer-instrumented builds against XML fixtures in non-production environments to surface bounds violations.
Monitor file integrity on directories that feed XML data into DICOM workflows.

Monitoring Recommendations

Alert on abnormal child-process termination of DICOM services parsing XML.
Capture and review syslog or Windows Event Log entries for application crashes referencing ofxml.
Track ingestion of XML files from external partners and correlate with parser exceptions.

How to Mitigate CVE-2026-12805

Immediate Actions Required

Update DCMTK to a build that includes commit 1d4b3815c0987840a983160bfc671fef63a3105b from the DCMTK Git Commit Update.
Rebuild and redeploy any internal applications that statically link ofstd.
Restrict XML inputs to XMLNode::parseFile to trusted, validated sources until patching is complete.

Patch Information

OFFIS published the corrective change in the DCMTK repository. The fix is tracked in the DCMTK Issue Tracker Entry and mirrored on GitHub. Integrators should pull the latest stable tag containing the patched ofstd/libsrc/ofxml.cc. Downstream Linux distributions and medical imaging vendors that ship DCMTK should publish rebuilt packages.

Workarounds

Disable or wrap workflows that call XMLNode::parseFile on untrusted XML until patches are applied.
Pre-validate incoming XML against a strict schema and size limit before handing it to DCMTK utilities.
Run DCMTK tools under a least-privilege account with filesystem and network restrictions to contain potential impact.

bash

# Build DCMTK from the patched upstream source
git clone https://github.com/DCMTK/dcmtk.git
cd dcmtk
git checkout 1d4b3815c0987840a983160bfc671fef63a3105b
mkdir build && cd build
cmake -DCMAKE_BUILD_TYPE=Release ..
cmake --build . --parallel
sudo cmake --install .