CVE-2026-97059

HighCVSS 8.2/10Last modified Sep 30, 2026

Description

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Sep 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-970607.2X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete user CVE-2026-970614.3Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enume CVE-2026-970625.4Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin,CVE-2026-970639.1X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys CVE-2026-970649.1X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauth CVE-2026-970657.1Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.CVE-2026-970665.3Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.CVE-2026-970676.5Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.CVE-2026-970706.9Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configure CVE-2026-970715.3Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through CVE-2026-970744.3Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.CVE-2026-970756.5Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.