HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-97059 — DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoad...

·Source: NIST NVD

Updated:

Executive Summary

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory.

Analysis

DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData buffer length against the declared NumberOfFrames. Attackers can craft malicious DICOM instances declaring more frames than the buffer contains to trigger heap over-reads that crash the application or leak adjacent heap memory. CVSS Score: 8.2. Published: 2026-09-24T14:18:21.997.

Indicators of Compromise (1)

CVE (1)
CVE-2026-97059
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 24, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

US is looking to weave AI into critical infrastructure for cybersecurity, national cyber director says

Sean Cairncross said CEOs need to be cognizant of how it’s being used, however. The post US is looking to weave AI into critical infrastructure for cybersecurity, national cyber director says appeared first on CyberScoop .

CyberScoop
CRITICALVulnerabilityNEW

Cyberattacks to be insured like accidents: Ministry of Finance discusses new rules for critical infrastructure

Roman Zaharov reports: Cyberattacks may start to be insured according to the principle already in effect for hazardous facilities. The Russian Ministry of Finance is discussing the possibility of making cyber risk insurance mandatory for businesses associated with critical infrastructure. This was stated by Deputy Finance Minister Ivan Chebeskov on the sidelines of the Moscow... Source

DataBreaches.net
LOWVulnerability

Shocker: suspected ShinyHunters member charged with attempted incitement to commit two murders

Anyone following the recent arrest of Pepijn van der Stap, the previously convicted hacker known as “Umbreon,” was likely shocked today when the prosecution announced that he was being charged with two counts of attempted incitement to murder. Here’s what we know so far. A 24-year-old Dutch national who previously served time for hacking-related crimes... Source

DataBreaches.net