CVE-2026-97059Published
DCMTK through 3.7.0 Heap Over-read via NumberOfFrames
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-97059 · Microsoft / collected KEV context
cve-program · CVE-2026-97059
- https://support.dcmtk.org/redmine/issues/1281
- https://github.com/DCMTK/dcmtk/commit/18379d5b8d234977cc30644e9e70d76d89c87285
- https://github.com/DCMTK/dcmtk/commit/c33790827a192a598d20463af701a8b819f46ec1
- https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L334-L360
- https://github.com/DCMTK/dcmtk/blob/ccfd10b84ff3c9a40b7b331698aedf06d421fc43/dcmfg/libsrc/concatenationloader.cc#L399-L430
- https://github.com/DCMTK/dcmtk
- https://www.vulncheck.com/advisories/dcmtk-through-3.7.0-heap-over-read-via-numberofframes
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.