CVE-2026-44628: Worklist Server DoS Vulnerability

CVE-2026-44628 Overview

CVE-2026-44628 is a denial-of-service vulnerability affecting the DCMTK worklist server, a widely deployed component of the DICOM Toolkit used in medical imaging environments. An unauthenticated remote attacker can crash the worklist server by sending a single crafted query. Exploitation requires the server to have a valid Called Application Entity (AE) Title, a configured storage directory, the expected lockfile in place, and at least one matching worklist record. The flaw is classified as a Type Confusion issue [CWE-843]. CISA published medical device advisory ICSMA-26-181-01 covering this weakness because the affected component is embedded in healthcare imaging workflows.

Critical Impact
A single unauthenticated network query can terminate the worklist service, disrupting DICOM Modality Worklist availability for connected medical imaging systems.

Affected Products

DCMTK DICOM Toolkit worklist server (wlmscpfs component)
Medical imaging systems and PACS integrations that embed the DCMTK worklist server
Deployments exposing DICOM services on the network with a configured Called AE Title and populated worklist storage

Discovery Timeline

2026-06-30 - CVE-2026-44628 published to NVD
2026-07-01 - Last updated in NVD database
2026 - CISA publishes medical advisory ICSMA-26-181-01

Technical Details for CVE-2026-44628

Vulnerability Analysis

The vulnerability resides in the DCMTK worklist server, which implements the DICOM Modality Worklist (MWL) SCP service. The server accepts DICOM C-FIND requests from imaging modalities to return scheduled procedure information. Processing of a crafted query causes a type confusion condition [CWE-843], where the server interprets a resource under one type assumption while it actually represents another. The mismatch produces an unrecoverable fault and the worklist process terminates. Attackers do not need credentials, user interaction, or elevated privileges. They only need network reachability to the DICOM listener and knowledge of the Called AE Title, which is often documented or discoverable during DICOM association negotiation.

Root Cause

The root cause is improper type handling during worklist record processing. When the server matches an incoming C-FIND identifier against on-disk worklist records, it operates on a resource under an incorrect type assumption. Because the prerequisite state includes a valid Called AE Title, configured storage directory, the expected lockfile, and at least one matching record, the faulty code path is reached deterministically once these conditions are met.

Attack Vector

The attack vector is network-based and does not require authentication. An attacker initiates a DICOM association with the worklist SCP using a known Called AE Title. After association, the attacker issues a single crafted C-FIND worklist query that triggers the type confusion. The worklist server process crashes, halting Modality Worklist services for every downstream imaging device. No verified public exploit code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the CISA Medical Advisory ICSMA-26-181-01 for additional technical context.

Detection Methods for CVE-2026-44628

Indicators of Compromise

Unexpected termination or repeated restarts of the DCMTK worklist server process (wlmscpfs or equivalent)
DICOM C-FIND requests from unknown source IPs immediately preceding a service crash
Gaps in Modality Worklist availability correlated with inbound traffic on the DICOM port (commonly TCP 104, 4242, or 11112)

Detection Strategies

Monitor process lifecycle events for the worklist server binary and alert on abnormal exits
Inspect DICOM association logs for unfamiliar Calling AE Titles issuing C-FIND-RQ against the worklist service
Correlate service restarts with network flow records to identify the source of the triggering association

Monitoring Recommendations

Capture and retain DICOM protocol logs, including association requests, PDU exchanges, and C-FIND identifiers
Baseline expected Calling AE Titles and alert on deviations reaching the worklist SCP
Ingest host and network telemetry into a centralized analytics platform to correlate crashes with inbound queries

How to Mitigate CVE-2026-44628

Immediate Actions Required

Restrict network access to the DICOM worklist port so only authorized modalities and PACS components can reach it
Enforce an allowlist of Calling AE Titles at the worklist SCP and reject unknown peers at association negotiation
Deploy the latest DCMTK release from the DCMTK GitHub releases page once a fixed version is confirmed by the maintainers

Patch Information

Refer to the DCMTK GitHub Latest Release for updated builds and to the CISA CSAF advisory for the machine-readable vulnerability disclosure. Medical device operators should coordinate with device manufacturers before applying upstream DCMTK updates to embedded imaging systems.

Workarounds

Place the worklist SCP behind a DICOM-aware proxy or firewall that enforces peer authentication via AE Title and source IP
Segment imaging networks so the worklist service is unreachable from general enterprise or guest networks
Configure automated service supervision to restart the worklist process after a crash while investigation and patching are in progress

bash

# Configuration example: restrict inbound DICOM traffic to trusted modalities
# Replace 104 with the port used by your worklist SCP (e.g., 4242, 11112)
iptables -A INPUT -p tcp --dport 104 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 104 -j DROP