CVE-2026-50254: Storescp Memory Leak DoS Vulnerability

CVE-2026-50254 Overview

CVE-2026-50254 is a memory leak vulnerability [CWE-401] in the DICOM Toolkit (DCMTK) affecting the storescp DICOM storage service. An unauthenticated remote attacker can repeatedly send a single crafted connection request that causes memory to grow unbounded. When storescp runs in its default single-process mode, memory consumption escalates quickly until the operating system kills the service. Once terminated, the service stops accepting connections and requires manual operator intervention to restart. The vulnerability affects medical imaging infrastructure, prompting a CISA ICS Medical Advisory (ICSMA-26-181-01).

Critical Impact
Unauthenticated attackers can crash DICOM storage services over the network with minimal traffic, disrupting medical imaging workflows and requiring manual recovery.

Affected Products

DCMTK (DICOM Toolkit) storescp service in default single-process mode
Medical imaging systems and PACS integrations using vulnerable DCMTK builds
Healthcare infrastructure components referenced in CISA advisory ICSMA-26-181-01

Discovery Timeline

2026-06-30 - CVE-2026-50254 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-50254

Vulnerability Analysis

The vulnerability is a missing release of memory after effective lifetime [CWE-401]. Each crafted connection request allocates memory inside storescp that is never freed. Because the flaw is reachable before authentication, attackers require no credentials, no user interaction, and no prior access to the network segment beyond reachability to the DICOM listener port.

An attacker automates repeated connection attempts, and the leaked allocations accumulate in the process heap. In DCMTK's default single-process configuration, storescp handles all incoming associations within one address space. Memory pressure escalates until the kernel OOM killer or an internal allocation failure terminates the process. The listener then goes dark and does not automatically respawn, producing sustained denial of service against downstream imaging workflows.

Root Cause

The root cause is an allocation path in the DICOM association handling logic that fails to free buffers when a crafted request triggers an early termination or error branch. Because the leak occurs per request rather than per session, the attacker does not need to complete a full DICOM negotiation to drain memory.

Attack Vector

The attack vector is network-based against any exposed storescp endpoint. The attacker opens a TCP connection to the DICOM port, sends the crafted association request, and repeats the operation in a loop. No authentication, credentials, or DICOM Application Entity Title validation obstacles apply before the leak occurs. Refer to the CISA ICS Medical Advisory and the DCMTK Release Notes for protocol-level details.

Detection Methods for CVE-2026-50254

Indicators of Compromise

Sustained growth of the storescp process resident set size (RSS) without corresponding legitimate study volume
Repeated short-lived TCP connections to the DICOM listener port from a single or small set of source IPs
storescp process exit events followed by refused connections on the DICOM port
OOM killer entries in dmesg or systemd journal naming storescp

Detection Strategies

Monitor storescp process memory over time and alert on abnormal growth rates that do not correlate with study throughput
Baseline DICOM connection rates per source IP and alert on sudden spikes of incomplete associations
Correlate service termination events with preceding inbound connection bursts to identify exploitation attempts

Monitoring Recommendations

Enable verbose DCMTK logging to capture association request metadata for post-incident review
Forward DICOM host telemetry, including process metrics and connection logs, to a centralized analytics platform for correlation
Track service uptime and automatic restart failures for storescp as a first-order availability signal

How to Mitigate CVE-2026-50254

Immediate Actions Required

Restrict network access to the storescp listener port to known imaging modalities and PACS peers using host firewalls or network ACLs
Run storescp with the multi-process fork mode where each association is isolated in a child process, limiting the blast radius of the leak
Deploy a process supervisor (systemd, monit) to automatically restart storescp after termination while investigation is ongoing

Patch Information

Apply the fixed DCMTK release referenced in the DCMTK Release Notes. Vendors that embed DCMTK in medical devices should track updates through the CISA ICS Medical Advisory and the CSAF advisory document.

Workarounds

Place storescp behind a DICOM-aware proxy or gateway that rate-limits inbound associations from untrusted sources
Enforce network segmentation so only authorized imaging equipment can reach the DICOM listener
Configure resource limits (ulimit, cgroup memory caps) to bound storescp memory use and enable predictable restart behavior

bash

# Configuration example: restrict storescp exposure and cap memory via systemd
# /etc/systemd/system/storescp.service.d/override.conf
[Service]
MemoryMax=2G
Restart=always
RestartSec=5

# Firewall example: allow only known modality subnet
iptables -A INPUT -p tcp --dport 104 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 104 -j DROP