CVE-2026-12805: DCMTK XML Buffer Overflow – Patch Guidance for Healthcare IT

Technical summary

CVE-2026-12805 is a heap-based buffer overflow in DCMTK's XMLNode::parseFile function located in ofstd/libsrc/ofxml.cc. The flaw results from insufficient bounds checking during XML file parsing, allowing an attacker to write beyond allocated buffer boundaries. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) and CWE-122 (Heap-based Buffer Overflow). With a CVSS score of 6.3 (MEDIUM severity), the attack vector is network-accessible, requires low complexity, no privileges, but does require user interaction. The vulnerability can impact confidentiality, integrity, and availability.

Business impact

For organizations deploying DCMTK in medical imaging workflows, clinical research, or DICOM processing pipelines, this vulnerability poses operational risk. A compromised DCMTK instance could leak patient imaging metadata, corrupt diagnostic images, or crash critical imaging systems. The requirement for user interaction means the attack surface is conditional on staff opening untrusted DICOM files or XML documents—a realistic scenario in environments receiving imaging data from external sources or untrusted channels. Downtime in imaging infrastructure directly impacts clinical operations and patient care timelines.

Affected systems

OFFIS DCMTK versions up to and including 3.7.0 are affected. DCMTK is deployed in medical imaging applications, hospital information systems, research platforms, and standalone DICOM processing tools. Any organization running affected versions that parse XML files as part of DICOM workflows or standalone XML processing faces exposure. Verify your specific DCMTK version and deployment context to determine risk.

Exploitability

A public exploit is available, increasing the practical risk. The vulnerability is trivial to exploit from a technical standpoint—an attacker simply crafts a malicious XML file and waits for a user to process it. The requirement for user interaction (opening a file, initiating a scan, importing data) is the primary control, not the underlying flaw. Given that medical facilities routinely exchange DICOM files and XML-based configuration data with partners and vendors, social engineering or supply chain delivery of malicious files is plausible.

Remediation

Update DCMTK to a patched version released after the vendor's response. The vendor confirmed they received early notification and released a fix promptly; verify the specific version number against the official OFFIS DCMTK release notes. The patch commit referenced is 1d4b3815c0987840a983160bfc671fef63a3105b. Organizations unable to patch immediately should restrict XML file processing to trusted sources, disable DCMTK XML parsing if unused, or isolate imaging systems from untrusted network inputs.

Patch guidance

Contact OFFIS or consult the official DCMTK repository and release notes to identify the minimum patched version for your branch. Apply the patch to all systems running DCMTK versions up to 3.7.0. Test patched versions in a staging environment first, especially in clinical settings, to ensure compatibility with existing workflows. Document the patch version applied and verify deployment across all instances. Prioritize systems that accept XML or DICOM files from external or untrusted sources.

Detection guidance

Monitor for unexpected crashes or errors in DCMTK processes, especially when processing XML files. Intrusion detection signatures targeting heap overflow exploitation patterns may trigger on malicious XML payloads. Log all XML file parsing operations and examine files uploaded to DCMTK systems for suspicious structure or encoding. Network-level detection is difficult; focus on host-based monitoring and application logging. Verify that DCMTK debug symbols and core dump analysis are enabled in your environment to aid forensic investigation if an incident occurs.

Why prioritize this

Although rated MEDIUM severity, the combination of public exploit availability, remote attack vector, and real-world deployment in critical healthcare infrastructure warrants prompt attention. The user-interaction requirement reduces immediate risk compared to wormable flaws, but should not delay patching. For organizations processing untrusted DICOM files or exposing DCMTK to external inputs, this should be a near-term remediation priority.

Risk score, explained

CVSS 6.3 (MEDIUM) reflects the balance between a network-accessible, low-complexity attack and the requirement for user interaction. The flaw impacts all three security pillars—confidentiality (information leak), integrity (data corruption), and availability (crash)—justifying a mid-range score. However, practical risk is elevated by public exploit availability and deployment in safety-critical medical environments; organizations should weight business context above the base CVSS score.

Frequently asked questions