CISA flags five DCMTK flaws in medical imaging toolkit
The ugly part is not the CVSS score; it is unauthenticated network reach into software many hospitals only see through a vendor appliance.
TL;DR
CISA warned that OFFIS DCMTK Toolkit versions 3.7.0 and earlier contain five critical and high-severity flaws affecting DICOM medical imaging systems worldwide. The bugs include path traversal, memory leaks and type confusion, allowing unauthenticated attackers to write files outside intended directories, read worklist records, exhaust memory or crash client and server processes. Healthcare operators, MSPs and public-sector IT teams need inventory first, because the fix is in commits and a future GitHub release, not a clearly dated production package.
CISA’s advisory puts a basic medical-imaging dependency on the immediate triage list: OFFIS DCMTK Toolkit 3.7.0 and earlier. The five CVEs are not theoretical checklist material. One path traversal flaw, CVE-2026-50003, lets a malicious or compromised server make a DCMTK client write files outside the selected output directory. Another, CVE-2026-52868, lets an unauthenticated attacker read worklist records outside the intended per-AE storage area, which CISA says can cross departmental or clinic separation in multi-area deployments. Two memory-leak flaws can kill single-process storescp deployments until an operator restarts the service. CVE-2026-44628 can crash the worklist server with a crafted query under specified server conditions.
The practitioner problem is discovery. DCMTK is a DICOM toolkit, not necessarily a brand name on the equipment rack, so hospitals, municipal health systems, defense medical contractors and their managed service providers may have to find it through imaging applications, embedded components and vendor bills of materials. CISA lists Healthcare and Public Health as the affected critical infrastructure sector and worldwide deployment, which is the polite way of saying this may be in more places than the asset inventory admits.
The remediation language is thinner than operators would like. CISA says the maintainer has provided a fix in the latest commits and points users to the latest GitHub release once it becomes available. That leaves the uncomfortable production question open: whether affected deployments can consume a snapshot, whether vendors will backport fixes to 3.7.0-based products, or whether customers wait for a packaged upgrade from the imaging system vendor.
Monday work is concrete: identify DCMTK at or below 3.7.0, check whether storescp or worklist services are reachable from untrusted networks, reduce exposure, and press vendors for a fixed build rather than a general assurance. CISA’s standard ICS advice still applies: keep these systems off the internet, separate them from business networks, and update remote-access paths before treating a VPN as a compensating control.
Published ·Deep Fathom