CVE-2026-44036: OFFIS DCMTK XML-to-DICOM DOS Vulnerability

CVE-2026-44036 Overview

CVE-2026-44036 is an uncontrolled recursion vulnerability [CWE-674] in OFFIS DCMTK 3.7.0, a widely deployed DICOM medical imaging toolkit. The flaw resides in the XML-to-DICOM converter located in dcmdata/libdcxml/xml2dcm.cc, where DcmXMLParseHelper::parseDataSet() and DcmXMLParseHelper::parseSequence() call each other without any depth limit. An attacker who supplies a crafted XML file containing deeply nested sequence and item elements can exhaust the process stack. The result is a denial of service through process crash. The xml2dcm command-line tool and any service that converts untrusted XML to DICOM using this code path are affected.

Critical Impact
Stack exhaustion in DICOM-processing pipelines can crash medical imaging services, disrupting XML-to-DICOM conversion workflows used in healthcare and research environments.

Affected Products

OFFIS DCMTK 3.7.0
The xml2dcm conversion utility shipped with DCMTK
Any application linking the DCMTK libdcxml library for XML-to-DICOM conversion of untrusted input

Discovery Timeline

2026-10-08 - CVE-2026-44036 published to NVD
2026-10-08 - Last updated in NVD database
Patch commit - Fix landed in DCMTK commit 87f256d73e30656a822bf7d76d1cf1d9bb693954

Technical Details for CVE-2026-44036

Vulnerability Analysis

The DCMTK XML parser reconstructs DICOM datasets from XML representations. DICOM sequences (SQ VR elements) can contain items, and each item can itself contain further nested sequences. The parser handles this recursive structure through mutual recursion: parseDataSet() processes dataset nodes and invokes parseSequence() when it encounters a sequence, which in turn calls back into parseDataSet() for each item.

In the vulnerable code, neither function tracks or bounds the recursion depth. An attacker-controlled XML document with thousands of nested <sequence> and <item> elements forces the parser to recurse until the native thread stack is exhausted. The process then terminates abnormally, denying service to legitimate conversion requests.

Root Cause

The root cause is the absence of a nesting depth check in DcmXMLParseHelper::parseSequence(). User-supplied XML directly controls recursion depth, which falls under [CWE-674: Uncontrolled Recursion]. The upstream fix introduces a depth parameter and the DCMXML_MAX_SEQUENCE_NESTING constant, returning EC_NestingDepthLimitExceeded when the limit is crossed.

Attack Vector

Exploitation requires the victim to parse a malicious XML file with the vulnerable code path. This typically means invoking xml2dcm on an attacker-supplied file or submitting XML to a service that uses libdcxml for conversion. User interaction is required in the default command-line scenario, but automated pipelines that ingest external XML are exposed without interaction.

// Patch excerpt from dcmdata/libdcxml/xml2dcm.cc
 OFCondition DcmXMLParseHelper::parseSequence(
     DcmSequenceOfItems *sequence,
+    size_t depth,
     xmlNodePtr current,
     E_TransferSyntax xfer,
     const OFBool stopOnError)
 {
+    if (depth > DCMXML_MAX_SEQUENCE_NESTING)
+    {
+        DCMDATA_ERROR("DcmXMLParseHelper: maximum sequence nesting level "
+            << DCMXML_MAX_SEQUENCE_NESTING << " exceeded");
+        return EC_NestingDepthLimitExceeded;
+    }
+
     OFCondition result = EC_Normal;
     if (sequence != NULL)
     {

Source: DCMTK commit 87f256d

Detection Methods for CVE-2026-44036

Indicators of Compromise

Unexpected termination or segmentation faults in processes linking libdcxml or invoking xml2dcm
Core dumps showing deep call stacks alternating between DcmXMLParseHelper::parseDataSet and DcmXMLParseHelper::parseSequence
Inbound XML files with hundreds or thousands of nested <sequence> or <item> elements

Detection Strategies

Scan DICOM conversion inputs for XML documents whose nesting depth exceeds a conservative threshold before passing them to DCMTK
Monitor DCMTK-based services for abnormal exit codes, stack-overflow signals (SIGSEGV), and sudden drops in conversion throughput
Inventory binaries and containers that embed DCMTK 3.7.0 to identify exposed conversion endpoints

Monitoring Recommendations

Log and alert on xml2dcm crashes and short-lived child processes spawned from imaging workflows
Correlate parser crashes with the source and size of the XML input to spot abuse patterns
Track file-ingestion queues for repeated submissions of malformed or oversized XML from the same origin

How to Mitigate CVE-2026-44036

Immediate Actions Required

Update DCMTK to a build that includes commit 87f256d73e30656a822bf7d76d1cf1d9bb693954 or newer
Restrict xml2dcm execution to trusted operators and avoid running it against untrusted XML
Isolate services that convert external XML to DICOM behind resource-limited sandboxes or containers

Patch Information

The upstream fix is available in the DCMTK GitHub commit 87f256d, tracked in the DCMTK Issue Tracker Entry 1224. The patch adds a depth parameter to parseSequence() and enforces DCMXML_MAX_SEQUENCE_NESTING, returning EC_NestingDepthLimitExceeded when exceeded. Rebuild downstream applications against the patched library.

Workarounds

Pre-validate incoming XML by rejecting documents whose nesting depth exceeds a safe limit (for example, 64 levels)
Enforce per-process stack and CPU limits with ulimit, systemd resource controls, or container cgroups so that a crash does not degrade the host
Run conversion workers under process supervision so that a crash triggers a controlled restart rather than service outage

bash

# Enforce stack and CPU limits on the xml2dcm worker
ulimit -s 8192        # cap stack size at 8 MiB
ulimit -t 30          # cap CPU time at 30 seconds
xml2dcm input.xml output.dcm