As reported by CISA in advisory ICSMA-26-181-01, the OFFIS DCMTK Toolkit — a foundational open-source library underpinning medical imaging systems globally — carries five serious vulnerabilities affecting all versions up to and including 3.7.0. With a top CVSS v3 score of 9.8 (Critical), these findings demand immediate attention from every healthcare organization relying on DICOM-based imaging infrastructure.

Security Impact: As reported by CISA in advisory ICSMA-26-181-01, the OFFIS DCMTK Toolkit — a foundational open-source library underpinning medical imaging systems globally — carries five serious vulnerabilities affecting all versions up to and including 3.7.0.

Vulnerability Summary

CVE-2026-50003 — Path Traversal (CWE-22)
A malicious or compromised server can force a DCMTK client operating in bit-preserving C-GET storage mode to write files outside the designated output directory using relative path sequences (e.g., ../). This enables arbitrary file write on client systems.
CVE-2026-50254 — Missing Release of Memory After Effective Lifetime (CWE-401)
Memory leak vulnerabilities that can be exploited to exhaust system resources, potentially leading to denial-of-service conditions on clinical imaging servers.
CVE-2026-35505 — Type Confusion (CWE-843)
Access of resource using incompatible type, which can result in unpredictable behavior, memory corruption, or process crashes when malformed DICOM data is processed.
CVE-2026-52868 — (Details per CISA advisory)
Additional vulnerability within the same DCMTK attack surface, contributing to the overall risk profile of the toolkit.
CVE-2026-44628 — (Details per CISA advisory)
Further flaw enabling unauthorized information access or process instability within affected DCMTK deployments.
Attribute Detail
Vendor OFFIS (Germany)
Affected Product DCMTK Toolkit ≤ 3.7.0
Max CVSS v3 Score 9.8 — Critical
Sectors Affected Healthcare and Public Health
Deployment Scope Worldwide
Active Exploitation Not confirmed at time of advisory; threat remains elevated

Why This Is Especially Dangerous in Healthcare Environments

DCMTK is not a niche product — it is embedded in a staggering number of DICOM-compliant systems: PACS servers, radiology workstations, CT and MRI integration layers, and telemedicine platforms. Because it functions as a middleware library, it often operates invisibly within larger vendor solutions, meaning many healthcare IT teams may not even know they are running a vulnerable version.

The path traversal vulnerability (CVE-2026-50003) is particularly alarming. In a clinical setting, an attacker who can position themselves as a malicious DICOM server — via a compromised network node, a rogue device, or a man-in-the-middle attack on an inadequately segmented clinical network — can write arbitrary files to imaging workstations and servers. This is a direct precursor to ransomware deployment, persistence mechanisms, or credential harvesting tooling.

Shield53 Perspective: The healthcare sector's attack surface for DICOM-based exploits is systematically underestimated. Clinical imaging networks frequently lack the same scrutiny applied to EHR systems, creating fertile ground for lateral movement once initial access is achieved through a vulnerability like these.

The type confusion and memory exhaustion vulnerabilities compound the risk. In environments where imaging services must maintain high availability — emergency radiology, ICU monitoring, surgical imaging — a process crash or memory exhaustion event is not merely a security incident; it is a patient safety event.

Broader Implications: The Open-Source Medical Library Risk

This advisory arrives alongside CISA's concurrent advisory on the pydicom/pynetdicom libraries, signaling a broader pattern: the open-source DICOM ecosystem is under increasing scrutiny, and rightfully so. Healthcare organizations have long benefited from these libraries' accessibility and cost efficiency, but the security maintenance model for such projects often cannot match the threat landscape they now face. Security teams should treat DCMTK and similar libraries as critical infrastructure components requiring formal vulnerability tracking — not as incidental dependencies.

Shield53 Recommendations

Immediate Actions

Shield53 Recommendations
Audit your DCMTK version immediately. Identify every system, appliance, and vendor product in your environment that bundles DCMTK. Version 3.7.0 and below are vulnerable. Engage medical device vendors for patch timelines if DCMTK is embedded in third-party equipment.
Apply the latest OFFIS DCMTK patch as soon as it is available. Monitor the official OFFIS DCMTK GitHub repository and CISA advisory page for updated guidance.
Segment clinical imaging networks. DICOM traffic should never flow freely across flat networks. Implement strict VLAN segmentation isolating PACS, modalities, and viewing workstations from general enterprise traffic.
Restrict outbound DICOM connections. Implement firewall rules that permit C-GET and C-STORE operations only to known, verified DICOM endpoints. Unknown or unauthenticated DICOM servers should be blocked by default.
Enable file integrity monitoring on systems running DCMTK clients to detect unauthorized file writes — a key indicator of CVE-2026-50003 exploitation attempts.
Monitor for memory anomalies on DICOM server processes. Unexplained memory growth or repeated process crashes on imaging services should be treated as a potential exploitation indicator.

Longer-Term Posture

  • Develop a formal medical device and medical software SBOM (Software Bill of Materials) process to surface embedded open-source libraries like DCMTK across your entire technology stack.
  • Engage your PACS and imaging system vendors in writing: demand disclosure of DCMTK version usage and commitment to patch timelines under your vendor risk management program.
  • Review CISA's full advisory at cisa.gov for the complete vulnerability detail and any updated mitigations as the advisory matures.